CVE-2026-27978

What it actually does

CVE-2026-27978 is a cross-site request forgery weakness in Next.js Server Actions affecting versions 16.0.1 through 16.1.6. During Server Action CSRF validation, Next.js incorrectly treated the HTTP Origin value `null` as if the Origin header were missing. Browsers can send `Origin: null` from opaque origins such as sandboxed iframes, data URLs, file contexts, or other restricted browsing contexts. Because this value was not evaluated as an explicit cross-origin origin, an attacker could cause a victim’s browser to submit a state-changing Server Action using the victim’s existing cookies or session credentials. The flaw does not directly expose data or allow unauthenticated server-side code execution, but it can permit unauthorized state changes where vulnerable Server Actions rely on framework origin validation as the primary CSRF defense.

Why it matters to the business

A successful attack could cause users to unknowingly perform actions in a Next.js application while they are logged in, such as changing settings, submitting forms, updating records, or triggering workflow actions. The impact depends on what Server Actions are exposed and what privileges the victim has. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV or associated with ransomware campaigns, but internet-facing applications with sensitive state-changing Server Actions should still treat the issue as important because exploitation requires only user interaction and can be delivered through a malicious web page.

How an attack unfolds

An attacker first identifies a Next.js application running an affected 16.x version that uses Server Actions for state-changing operations and relies on built-in origin validation to prevent CSRF. The attacker then crafts a malicious page that embeds or triggers a request from an opaque browser context, such as a sandboxed iframe, causing the browser to send `Origin: null`. If a logged-in victim visits the attacker-controlled page, the browser may automatically include the victim’s cookies or session credentials with the forged Server Action request, depending on cookie settings and browser behavior. In affected Next.js versions, the framework treats `origin: null` as equivalent to a missing origin rather than as a cross-origin value, so the request can bypass the intended origin/host comparison. The vulnerable application then processes the Server Action as though it were legitimate, performing the attacker-selected state change under the victim’s identity.

How to fix it

Upgrade Next.js to version 16.1.7 or later. The fix treats `'null'` as an explicit origin value and enforces host/origin validation unless `'null'` is deliberately allowlisted in `experimental.serverActions.allowedOrigins`. If immediate upgrade is not possible, add explicit CSRF tokens to sensitive Server Actions, require per-request unpredictable tokens tied to the user session, use `SameSite=Strict` for sensitive authentication cookies where application flows allow it, and avoid allowing `'null'` in `experimental.serverActions.allowedOrigins` unless there is a clear business requirement and compensating CSRF controls are in place. Review Server Actions that perform account, payment, administrative, configuration, data modification, or workflow-triggering operations and ensure they do not rely solely on framework origin validation in affected versions.

How to confirm the fix worked

Confirm the application is running Next.js 16.1.7 or later by checking the resolved package version in `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, build metadata, container image SBOMs, or deployed application dependency inventories. Verify that no affected runtime artifact still includes Next.js versions 16.0.1 through 16.1.6. Review configuration for `experimental.serverActions.allowedOrigins` and confirm `'null'` is not present unless intentionally required and protected by additional CSRF controls. Functionally test sensitive Server Actions by attempting requests with `Origin: null` from a controlled test client or browser harness; after remediation, such requests should be rejected unless explicitly and safely allowlisted. Also confirm sensitive actions require CSRF tokens or equivalent anti-forgery protections independent of origin checks.

Typical attack path

1. Identify a public Next.js application running version 16.0.1 through 16.1.6 that uses Server Actions.
2. Find state-changing Server Actions that can be invoked with predictable request parameters and rely on origin validation for CSRF protection.
3. Create an attacker-controlled web page that submits a Server Action request from an opaque origin, such as a sandboxed iframe, producing `Origin: null`.
4. Lure or redirect an authenticated victim to the malicious page through phishing, advertising, embedded content, or another social-engineering path.
5. The victim’s browser sends the forged request with `Origin: null` and, where permitted, the victim’s authentication cookies.
6. The affected Next.js server incorrectly treats the null origin as missing and does not enforce the expected cross-origin rejection.
7. The application executes the state-changing Server Action using the victim’s authenticated session.

How to detect it

To assess prior exploitation, review web server, reverse proxy, CDN/WAF, and application logs for authenticated state-changing requests to Next.js Server Action endpoints where the request header contains `Origin: null`. Focus on POST requests, requests with Next.js Server Action headers, and requests that resulted in successful 2xx or 3xx responses. Correlate these events with application audit logs for account changes, permission changes, profile updates, data modifications, transaction-like actions, or administrative operations performed by the affected user at the same time. Pay particular attention to requests with missing or suspicious `Referer` headers, unusual user agents, unexpected source geographies, or bursts of similar actions across multiple users. Because this is a browser-mediated CSRF issue, server-side evidence may look like legitimate user activity; investigation should center on the combination of `Origin: null`, authenticated cookies, state-changing methods, and unexpected business actions.

• Origin: null
• origin: null
• experimental.serverActions.allowedOrigins
• 'null'
• "null"
• Next-Action
• next-action
• POST /_actions
• POST /app
• POST /api

What your security team should do

• Inventory internet-facing and internal applications using Next.js Server Actions and identify deployments running Next.js 16.0.1 through 16.1.6.
• Prioritize upgrading affected applications to Next.js 16.1.7 or later, especially applications with authenticated state-changing Server Actions.
• Search application configuration for `experimental.serverActions.allowedOrigins` and remove `'null'` unless explicitly required and protected.
• Add or verify CSRF token validation on high-risk Server Actions such as account changes, administrative changes, transaction initiation, authorization changes, and data modification workflows.
• Harden authentication cookies for sensitive applications using `SameSite=Strict` where feasible, or `SameSite=Lax` plus strong CSRF tokens where strict mode would break legitimate flows.
• Review access logs for authenticated POST requests to Server Action endpoints containing `Origin: null`, especially where the `Referer` is absent, unusual, or points to unrelated domains.
• Correlate suspicious requests with user complaints, unexpected account changes, configuration modifications, or other state changes performed shortly after external browsing activity.
• Add SIEM detections for `Origin: null` on authenticated state-changing requests to Next.js applications.