GHSA-955p-x3mx-jcvp

Suggest an improvement
Source
https://github.com/advisories/GHSA-955p-x3mx-jcvp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-955p-x3mx-jcvp/GHSA-955p-x3mx-jcvp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-955p-x3mx-jcvp
Aliases
Downstream
Published
2026-07-22T23:00:34Z
Modified
2026-09-10T03:51:11Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Next.js: Unauthenticated disclosure of internal Server Function endpoints
Details

Impact

In Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.

Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).

Affected users are applications using App Router + Server Actions.

By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses.

Workarounds

Never assume any authentication claims at the use cache or use server boundary. Always authenticate within the boundary.

Database specific 
{
    "cwe_ids": [
        "CWE-201"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T23:00:34Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
13.0.0
Fixed
15.5.21

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-955p-x3mx-jcvp/GHSA-955p-x3mx-jcvp.json"

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
16.0.0
Fixed
16.2.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-955p-x3mx-jcvp/GHSA-955p-x3mx-jcvp.json"