CVE-2026-27978

🗓️ 17 Mar 2026 23:59:22Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 43 Views🌐 WEB

Fixes CSRF bypass for Server Actions when origin is null by treating it as a value and enforcing checks.

Reporter	Title	Published	Views	Family All 19
ATTACKERKB	CVE-2026-27978	17 Mar 202623:59	–	attackerkb
BDU FSTEC	The vulnerability of the Next.js software platform for creating web applications, related to the manipulation of cross-site requests, allows attackers to execute CSRF attacks.	13 May 202600:00	–	bdu_fstec
CNNVD	Next.js 安全漏洞	17 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-27978 Next.js: null origin can bypass Server Actions CSRF checks	17 Mar 202623:59	–	cvelist
EUVD	EUVD-2026-12684	17 Mar 202615:30	–	euvd
GithubExploit	nextjs-sa-dos-poc-20260413	12 Apr 202622:57	–	githubexploit
Github Security Blog	Next.js: null origin can bypass Server Actions CSRF checks	17 Mar 202615:30	–	github
Tenable Nessus	Next.js Framework 16.0.1 < 16.1.7 Multiple Vulnerabilities	20 Mar 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-27978	18 Mar 202600:00	–	nessus
NVD	CVE-2026-27978	18 Mar 202600:16	–	nvd

NVD

Vulners

Node

vercel next.jsRange16.0.1–16.1.7node.js

[
  {
    "vendor": "vercel",
    "product": "next.js",
    "versions": [
      {
        "version": ">= 16.0.1, < 16.1.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/vercel/next.js/commit/a27a11d78e748a8c7ccfd14b7759ad2b9bf097d8
github	www.github.com/vercel/next.js/releases/tag/v16.1.7
github	www.github.com/vercel/next.js/security/advisories/GHSA-mq59-m269-xvcx

Parameter	Position	Path	Description	CWE
Origin	header	/	Next.js Server Actions CSRF validation vulnerability exploited via Origin header leading to DoS (HTTP 500) in server actions; PoC targets root path with crafted Origin headers.	CWE-352

17 Jun 2026 10:28Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.3

CVSS 45.3

EPSS0.002

SSVC

CWE-352