CVE-2026-27977: Next.js Vulnerability Allows Null Origin to Bypass HMR Websocket CSRF Checks
Summary
CVE-2026-27977: Next.js: null origin can bypass dev HMR websocket CSRF checks. Affects next versions >= 16.0.1, < 16.1.7. Fixed in 16.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered React applications with ease. It provides features such as automatic code splitting, optimized performance, and a rich ecosystem of plugins. However, like any software, it is susceptible to vulnerabilities that can compromise the security of applications built with it. This specific vulnerability affects the development mode of Next.js, where the development server can be exposed to untrusted networks.
Vulnerability Detail
In the development mode of Next.js, the cross-site protection for internal websocket endpoints can mistakenly treat requests with 'Origin: null' as valid, even if 'allowedDevOrigins' is configured. This oversight allows privacy-sensitive contexts, such as sandboxed documents, to connect to the Hot Module Replacement (HMR) websocket channel unexpectedly. If an attacker can access the development server, they may exploit this vulnerability to interact with the websocket traffic, potentially leading to unauthorized access or manipulation of the development environment.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.1.7
This is the first release that contains the fix.
npm install next@16.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, consider the following workarounds: 1. Do not expose the 'next dev' server to untrusted networks. 2. Block websocket upgrades to '/_next/webpack-hmr' when 'Origin' is 'null' at your proxy. This can be done by configuring your web server or proxy settings to deny such requests.
Conclusion
The vulnerability identified as CVE-2026-27977 in Next.js poses a risk in development environments by allowing null origins to bypass CSRF checks for HMR websockets. It is crucial to update to the patched version or implement workarounds to safeguard your applications during development.
See every vulnerability recorded for next →
FAQ
The vulnerability allows an attacker to connect to the HMR websocket channel if the development server is accessible from untrusted content, potentially leading to unauthorized interactions with the development environment.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
No, this vulnerability specifically affects the development mode of Next.js and is not present in production environments.
If an upgrade is not possible, ensure that your development server is not exposed to untrusted networks and implement the suggested workarounds to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
