Next.js: null origin can bypass dev HMR websocket CSRF checks
Published 17 Mar 2026 · Updated 25 Mar 2026
Affected package
- Affected
- >=16.0.1 <16.1.7
- Fixed in
- 16.1.7
npm install next@16.1.7Details
Summary
In next dev, cross-site protections for internal development endpoints could treat Origin: null as a bypass case even when `allowedDevOrigins` is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly.
Impact
If a developer visits attacker-controlled content while running an affected next dev server with `allowedDevOrigins` configured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked.
This issue affects development mode only. It does not affect next start, and it does not expose internal debugging functionality to the network by default.
Patches
Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins on internal development endpoints.
Workarounds
If upgrade is not immediately possible:
- Do not expose
next devto untrusted networks. - If you use `allowedDevOrigins`, reject requests and websocket upgrades with
Origin: nullfor internal dev endpoints at your proxy.
Is GHSA-jcc7-9wpm-mj36 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.