GHSA-mq59-m269-xvcx
Suggest an improvement- Source
- https://github.com/advisories/GHSA-mq59-m269-xvcx
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mq59-m269-xvcx/GHSA-mq59-m269-xvcx.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-mq59-m269-xvcx
- Aliases
- Downstream
- Published
- 2026-03-17T15:30:14Z
- Modified
- 2026-03-19T18:34:30Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Next.js: null origin can bypass Server Actions CSRF checks
- Details
-
Summary
origin: nullwas treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.Impact
An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).
Patches
Fixed by treating
'null'as an explicit origin value and enforcing host/origin checks unless'null'is explicitly allowlisted inexperimental.serverActions.allowedOrigins.Workarounds
If upgrade is not immediately possible:
- Add CSRF tokens for sensitive Server Actions.
- Prefer
SameSite=Stricton sensitive auth cookies. - Do not allow
'null'inserverActions.allowedOriginsunless intentionally required and additionally protected.
- Database specific
{ "cwe_ids": [ "CWE-352" ], "github_reviewed": true, "github_reviewed_at": "2026-03-17T15:30:14Z", "nvd_published_at": "2026-03-18T00:16:20Z", "severity": "MODERATE" }- References
Affected packages
npm / next
Package
- Name
- next
- View open source insights on deps.dev
- Purl
- pkg:npm/next