GHSA-jcc7-9wpm-mj36

Source

https://github.com/advisories/GHSA-jcc7-9wpm-mj36

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-jcc7-9wpm-mj36/GHSA-jcc7-9wpm-mj36.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jcc7-9wpm-mj36

Aliases

CVE-2026-27977

Published

2026-03-17T15:29:48Z

Modified

2026-03-17T15:46:26.028580Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Next.js: null origin can bypass dev HMR websocket CSRF checks

Details

Summary

In next dev, cross-site protection for internal websocket endpoints could treat Origin: null as a bypass case even if allowedDevOrigins is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly.

Impact

If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured allowedDevOrigins still allow connections from any origin.

Patches

Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins.

Workarounds

If upgrade is not immediately possible: - Do not expose next dev to untrusted networks. - Block websocket upgrades to /_next/webpack-hmr when Origin is null at your proxy.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1385"
    ],
    "severity": "LOW",
    "github_reviewed_at": "2026-03-17T15:29:48Z",
    "nvd_published_at": null
}

References

Affected packages

npm / next

Package

Name: next; View open source insights on deps.dev
Purl: pkg:npm/next

Affected ranges

Type: SEMVER
Events: Introduced

16.0.1

Fixed

16.1.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-jcc7-9wpm-mj36/GHSA-jcc7-9wpm-mj36.json"