Next.js opens a path for cross‑site request forgery on its development mode HMR websocket endpoint by treating an Origin header of "null" as a bypass, even if allowedDevOrigins is configured. The vulnerability causes an attacker to gain unchecked access to the hot‑module‑replacement channel, potentially exposing development data or disrupting the workflow. The weakness matches CWE‑1385 (Improper Validation of Data) and CWE‑346 (Improper Checking for Authorization). Based on the description, the likely attack vector is an attacker who can serve malicious content that can reach the dev server, such as via a local network or an exposed development port, and then initiate a websocket connection to the _next/webpack-hmr endpoint.

It affects Vercel Next.js versions starting at 16.0.1 up to, but not including, 16.1.7. Versions before 16.0.1 lack the problematic check, while any instance lacking a configured allowedDevOrigins will accept connections from any origin, including those with a null origin.

The CVSS score of 2.3 indicates low severity, and an EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the development server to be reachable from attacker‑controlled content, so the risk remains low unless the dev environment is exposed to untrusted networks. If exposed, an attacker can exploit the flaw by loading malicious content that issues a websocket request to /_next/webpack-hmr, bypassing the intended origin checks.