Next.js advisories in this batch: 9 (SSRF: 2, DoS: 3, cache confusion: 2, auth bypass: 1, endpoint disclosure: 1) (Source: GitHub Security Advisories (July 2026))
Nine Advisories, One Disclosure Cycle
Next.js published nine GitHub Security Advisories in a single coordinated batch in July 2026, spanning server-side request forgery, denial of service, authentication bypass, cache confusion, and unauthenticated endpoint disclosure. The advisories are not confined to edge cases. They target Server Actions, App Router, middleware, rewrites, the Image Optimization API, and the Edge runtime — the features that define Next.js's current architecture and that have driven its adoption over the past two years.
What's Affected
Two advisories describe server-side request forgery: one in Server Actions when forwarding or redirecting requests, allowing an attacker to route outbound server requests to an arbitrary host; the other in rewrites and redirects where the destination hostname is built from request-controlled input. A middleware bypass affects App Router applications built with Turbopack and a single i18n locale, allowing crafted requests to skip middleware-based authentication entirely. Three advisories target denial of service: one via crafted requests to Server Actions causing excessive CPU usage, one via unbounded payload size in the Edge runtime, and one via malicious SVGs in the Image Optimization API. Two cache confusion bugs can leak response bodies across requests to the same URL with different bodies. A final advisory discloses internal Server Action and 'use cache' endpoint IDs to unauthenticated users.
The Fastest-Growing Framework Gets Its Security Audit Moment
WebPulse's Tranco Top-10K framework census, completed in July 2026, found Next.js on 24.9% of scanned high-traffic domains, overtaking WordPress at 22.4% in the same sample. WebPulse's baseline data records 25 total CVEs for Next.js, against WordPress's 18,005 — a comparison that reflects two decades of age difference and vastly different disclosure norms (open-source vs. open-source-with-massive-plugin-ecosystem), not a like-for-like security assessment. This batch of nine advisories does not close that gap in any meaningful numerical sense. What it does is put pressure on a different claim: that modern frameworks are architecturally lower-risk by default. Several of these advisories target features that did not exist in earlier Next.js versions — Server Actions, App Router, the Edge runtime — meaning the attack surface is growing with adoption, not shrinking.
What This Means for the 'Modern vs. Legacy' Framing
WebPulse's scoring model has consistently ranked modern frameworks higher than legacy CMS platforms on security, and this batch does not change the overall scoring picture. But it introduces a nuance that the raw numbers obscure: modern frameworks accumulate fewer CVEs partly because they are younger, partly because they have smaller plugin surfaces, and partly because their architecture genuinely reduces certain classes of vulnerability. What this batch shows is that as these frameworks add server-side capabilities — server components, server actions, edge functions, caching layers — they also add server-side attack surface. An SSRF in Server Actions is not the same class of bug as a plugin-based SQL injection in WordPress, but it is a server-side vulnerability in a framework increasingly used for the same workloads WordPress historically served.
What Budget Signers Should Note
Patches are available for all nine advisories. Organizations running Next.js in production should update to the latest patched versions. The Tranco Top-10K sample skews toward well-resourced, high-traffic sites with faster patch cycles, so the broader Next.js install base — including smaller teams adopting it for the first time — may be slower to apply fixes. For organizations evaluating framework choices, this batch is a data point against a common simplification: that choosing a modern framework eliminates security maintenance. It reduces it. It does not eliminate it.
