CVE-2026-27977
Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.
Scoring
- Severity
- LOW
- CVSS base score
- 2.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.17%
- CWE
- CWE-1385
- Published
- 2026-03-17
- Last modified
- 2026-03-19
Affected products
- vercel next.js
Weakness type
Related vulnerabilities
- CVE-2026-88061 — career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution
- CVE-2026-85183 — Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
- CVE-2026-15580 — PassPortal browser extension: vault token disclosure via unvalidated postMessage
- CVE-2026-59950 — MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- CVE-2026-57111 — Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin
- CVE-2026-59804 — Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
- CVE-2026-10054 — In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged...
- CVE-2026-44211 — Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability