CVE-2026-27977
- Source
- https://cve.org/CVERecord?id=CVE-2026-27977
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27977.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-27977
- Aliases
- Published
- 2026-03-17T23:56:24.631Z
- Modified
- 2026-04-10T05:41:03.753784Z
- Severity
-
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Next.js: null origin can bypass dev HMR websocket CSRF checks
- Details
-
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in
next dev, cross-site protection for internal websocket endpoints could treatOrigin: nullas a bypass case even ifallowedDevOriginsis configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configuredallowedDevOriginsstill allow connections from any origin. The issue is fixed in version 16.1.7 by validatingOrigin: nullthrough the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not exposenext devto untrusted networks and/or block websocket upgrades to/_next/webpack-hmrwhenOriginisnullat the proxy. - Database specific
{ "cwe_ids": [ "CWE-1385" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27977.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/vercel/next.js/releases/tag/v16.1.7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27977.json
- https://github.com/vercel/next.js/security/advisories/GHSA-jcc7-9wpm-mj36
- https://nvd.nist.gov/vuln/detail/CVE-2026-27977
- https://github.com/vercel/next.js/commit/862f9b9bb41d235e0d8cf44aa811e7fd118cee2a