CVE-2026-27977

score

<0.1

cvss

5.4

epss

0.2%

published

2026-03-18

kev added

—

first seen

2026-10-21

Next.js 16.0.1 to <16.1.7 contains a cross-site request forgery caused by improper handling of 'Origin: null' in dev websocket endpoints, letting attackers connect to HMR websocket traffic in development mode, exploit requires dev server exposure to attacker-controlled content.