CVE-2026-64643

A flaw was found in Next.js. Unauthenticated users can exploit this vulnerability by accessing publicly served client artifacts, which may disclose Server Action IDs. This bypasses authentication on pages where these endpoints are used, leading to information disclosure. While primarily an enumeration primitive, this disclosure can increase overall risk when combined with other vulnerabilities.

This Moderate information disclosure vulnerability in Next.js applications allows unauthenticated users to obtain Server Action IDs from publicly served client artifacts. While primarily a reconnaissance primitive, this exposure could increase overall risk when chained with other weaknesses. Red Hat products and services that incorporate Next.js, such as Red Hat AMQ, Red Hat Enterprise Linux AI, and cloud.redhat.com offerings, are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upstream advises that applications should never assume authentication claims at the use server (Server Action) or use cache boundary: always perform authentication checks within the Server Action or cached function itself rather than relying on page-level authentication or on Server Action IDs remaining secret. In addition, the upstream fix is available in Next.js 15.5.21 and 16.2.11, and upgrading to a fixed version removes the exposure.