CVE-2026-27978

Description

Next.js: null origin can bypass Server Actions CSRF checks

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/vercel/next.js/security/advisories/GHSA-mq59-m269-xvcx
• https://nvd.nist.gov/vuln/detail/CVE-2026-27978
• https://github.com/vercel/next.js/commit/a27a11d78e748a8c7ccfd14b7759ad2b9bf097d8
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v16.1.7