npm/next CVE-2026-27977: low, EPSS 0.22%

Next.js: null origin can bypass dev HMR websocket CSRF checks

Action: Upgrade next to 16.1.7 or later.

npm i next@16.1.7

Affected

Fixed versions

Sources

• osv: GHSA-jcc7-9wpm-mj36
• https://github.com/vercel/next.js/security/advisories/GHSA-jcc7-9wpm-mj36
• https://nvd.nist.gov/vuln/detail/CVE-2026-27977
• https://github.com/vercel/next.js/commit/862f9b9bb41d235e0d8cf44aa811e7fd118cee2a
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v16.1.7

CVE-2026-27977 · published 2026-03-17T15:29:48Z · modified 2026-03-25T19:49:01.129152Z · JSON