Insertion of Sensitive Information Into Sent Data in Next.js - CVE-2026-64643
Published: July 22, 2026
Vulnerability identifier: #VU139036
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-64643
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: vercel
Affected software:
Next.js
Next.js
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose internal Server Function endpoints.
The vulnerability exists due to insertion of sensitive information into sent data in publicly served client artifacts when exposing Server Action references. A remote attacker can access client artifacts containing action references to disclose internal Server Function endpoints.
This affects applications using App Router with Server Actions or use cache, and the disclosure is typically a recon or enumeration primitive.
How to mitigate CVE-2026-64643
Install security update from vendor's website.