Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version 16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy.

The Next.js Framework on the remote host is affected by multiple vulnerabilities:

  - A vulnerability exists in the Next.js development server where a null origin can bypass cross-site     protections on the HMR (Hot Module Replacement) websocket endpoint. An attacker with access to     attacker-controlled content reachable from the dev server could potentially connect to the HMR websocket     channel and intercept dev traffic, even when allowedDevOrigins configuration is in place. This     vulnerability only affects development mode. (CVE-2026-27977)

  - A vulnerability exists in Next.js where requests with a null origin can bypass CSRF validation in Server     Actions. Requests from opaque contexts such as sandboxed iframes could bypass origin verification instead     of being validated as cross-origin requests. An attacker could manipulate a victim's browser into executing     state-changing Server Actions from a sandboxed context using victim credentials. (CVE-2026-27978)

  - A denial of service vulnerability exists in Next.js applications with Partial Prerendering enabled. The     system fails to consistently enforce maxPostponedStateSize limits when processing next-resume header     requests in non-minimal deployments, allowing an attacker to send oversized POST payloads with the     next-resume header to trigger unbounded memory buffering and cause excessive memory consumption     potentially leading to service disruption. (CVE-2026-27979)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and     prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat     `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-     sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is     reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket     channel and interact with dev websocket traffic. This affects development mode only. Apps without a     configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version     16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other     origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or     block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy. (CVE-2026-27977)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and
    prior to version 16.1.7, in `next dev`, cross-site protection for internal websocket endpoints could treat
    `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-
    sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is
    reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket
    channel and interact with dev websocket traffic. This affects development mode only. Apps without a
    configured `allowedDevOrigins` still allow connections from any origin. The issue is fixed in version
    16.1.7 by validating `Origin: null` through the same cross-site origin-allowance checks used for other
    origins. If upgrading is not immediately possible, do not expose `next dev` to untrusted networks and/or
    block websocket upgrades to `/_next/webpack-hmr` when `Origin` is `null` at the proxy. (CVE-2026-27977)

ID	Name	Product	Family	Severity
303199	Next.js Framework 16.0.1 < 16.1.7 Multiple Vulnerabilities	Nessus	Misc.	medium
302939	Linux Distros Unpatched Vulnerability : CVE-2026-27977	Nessus	Misc.	low
438900	SCA: security update for next (GHSA-jcc7-9wpm-mj36)	Tenable Cloud Security	SCA Checks	low
438900	SCA: security update for next (GHSA-jcc7-9wpm-mj36)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2026-27977

low

Tenable Plugins

medium

low

low

low