Next.js Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2026-27978

Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7 origin: null was treated as a quotmissingquot origin during Server Action CSRF validation. As a result requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a victim browser to submit Server Actions from a sandboxed context potentially executing state-changing actions with victim credentials (CSRF). This is fixed in version 16.1.7 by treating 39null39 as an explicit origin value and enforcing host/origin checks unless 39null39 is explicitly allowlisted in experimental.serverActions.allowedOrigins. If upgrading is not immediately possible add CSRF tokens for sensitive Server Actions prefer SameSiteStrict on sensitive auth cookies and/or do not allow 39null39 in serverActions.allowedOrigins unless intentionally required and additionally protected.