Next.js patches July security flaws across App Router and Server Actions

Next.js teams on the 15.5 and 16.2 lines have a concrete patch target: next@15.5.21 or next@16.2.11. The July 2026 security release covers high- and medium-severity issues across App Router, Server Actions, middleware/proxy behavior, SSRF paths, image optimization, internal endpoint disclosure, and fetch cache handling.

This is not a cosmetic dependency bump. Several issues affect common production surfaces, and Cloudflare's companion WAF release notes say some cases cannot be fully covered at the WAF layer. Updating the framework remains the control that matters.

The fixed Next.js versions

The official Next.js release says patches are available in v16.2.11 for Active LTS and v15.5.21 for Maintenance LTS. The fixes are also present in v16.3.0-canary.92 and v16.3.0-preview.7, with inclusion planned for v16.3.0 stable.

For most applications, the immediate command is straightforward:

npm install next@16.2.11
# or, for 15.5:
npm install next@15.5.21

Teams running preview or canary builds should pin to the patched preview/canary versions named by Next.js rather than assuming a nearby prerelease contains the same security fixes.

High-severity issues hit App Router paths

The release lists four high-severity items. CVE-2026-64641 affects App Router applications with at least one Server Action, where crafted requests can drive excessive CPU usage and cause denial of service in the same process.

CVE-2026-64642 affects App Router applications built with Turbopack and a single configured locale. The risk is middleware/proxy bypass, which is especially serious when middleware handles authentication, authorization, tenant routing, or security checks.

Two SSRF-related issues round out the high-severity group. CVE-2026-64645 involves rewrites or redirects that build an external destination hostname from attacker-controlled input. CVE-2026-64649 affects custom servers where Server Actions forward or redirect requests and the attacker can control Host-associated headers.

Medium-severity does not mean ignore

The medium-severity list includes denial of service in the Image Optimization API when self-hosted applications optimize malicious SVG content, unbounded Server Action payloads in the Edge runtime, unauthenticated disclosure of internal Server Function endpoint IDs, and two cache-confusion cases involving request bodies.

Those are different failure modes, so a single edge rule or config flag will not cover every case. Review whether your app uses remote image optimization, App Router Server Actions, custom servers, middleware/proxy authentication, rewrites(), redirects(), or server-side fetch() patterns with request bodies.

Cloudflare can help, but not replace patching

Cloudflare's July 21 WAF release added or confirmed coverage for several Next.js-related detections, including rules for CVE-2026-64641, CVE-2026-64649, and internal endpoint disclosure. It also notes existing SSRF protections for one rewrite/redirect case.

The same Cloudflare notes are clear about the limits: some issues are not possible to block reliably through WAF signatures, including the Turbopack middleware/proxy bypass and some application-logic or payload-size cases. That is the useful operational message: WAF coverage can reduce exposure while teams roll out, but it is not a substitute for patched Next.js dependencies.

Patch order for production teams

Start with public-facing App Router services, then prioritize apps using Server Actions, custom servers, Turbopack with i18n, remote image optimization, or middleware-based auth. After the package bump, run smoke tests around login, locale routing, Server Actions, image endpoints, redirects, and any security middleware.

If your dependency update is blocked, document the exposed patterns and apply temporary edge controls where they fit. The safest final state is still a patched Next.js version plus regression checks around the exact surfaces named in the advisory.

Evidence

This item was selected for the blog lane because it is an official framework security release with clear patched versions, multiple high-severity issues, and direct deployment work for production teams. The Cloudflare WAF notes were used as independent operational context, not as a replacement for the Next.js advisory.