Vercel has released a critical security patch addressing an issue discovered in Next.js Server Actions and internal cache invalidation routines within the App Router architecture.
Vulnerability Mechanism and Impact
The vulnerability originates from inconsistent origin header checks during Server Action invocations paired with cache tag key collisions. An attacker could potentially craft forged action calls or poison shared ISR edge caches, resulting in unauthorized data mutations or distribution of malicious cached content to downstream users.
Affected Versions and Recommended Actions
Impacted releases include specific subversions across Next.js 14 and 15 series. Developers must immediately upgrade their Next.js dependency to the patched releases via package managers. Furthermore, auditing Server Action endpoints for explicit session validation is strongly advised.