Insertion of Sensitive Information Into Sent Data in Next.js - CVE-2026-64643
Published: July 22, 2026
Vulnerability identifier: #VU139036
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64643
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose internal Server Function endpoints.
The vulnerability exists due to insertion of sensitive information into sent data in publicly served client artifacts when exposing Server Action references. A remote attacker can access client artifacts containing action references to disclose internal Server Function endpoints.
This affects applications using App Router with Server Actions or use cache, and the disclosure is typically a recon or enumeration primitive.
Affected software
Next.js
Event Processing
Event Processing
How to mitigate CVE-2026-64643
Install security update from vendor's website.
Next.js - update to 16.2.11
Event Processing - update to 1.5.5
Event Processing - update to 1.5.5