In Next.js, when an HTTP request’s origin header is set to the string "null" it is currently treated as if no origin were supplied during Server Action CSRF validation. This logic flaw means that requests originating from opaque contexts—such as sandboxed iframes or other contexts that set the origin to "null"—are effectively allowed through the CSRF check. An attacker can exploit this behavior by causing a victim’s browser to load a malicious resource that sends a Server Action request with an origin of "null". Because the request is not rejected, the action can be executed with the victim’s credentials, resulting in unauthorized state change. The affected weakness is a missing origin check (CWE‑346) and a classic Cross‑Site Request Forgery vulnerability (CWE‑352).

The vulnerability affects the Vercel Next.js framework. All releases in the 16.x series from version 16.0.1 up through 16.1.6 are affected. The specific product identifier is cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*. No other vendors or products are listed as affected.

The CVSS score of 5.3 indicates a moderate severity. EPSS is recorded as less than 1%, implying a low projected exploitation likelihood under current threat intelligence. This issue is not listed in the CISA KEV catalog. The attack vector is client‑side: an attacker must embed a malicious iframe or otherwise force a victim’s browser to issue a Server Action with an origin of "null". Exploitation requires that the target application enables Server Actions and that a user who is authenticated visits or views the malicious content. If an application has elevated privileges tied to these actions, the misuse can lead to unauthorized data modification. Given the requirements, the immediate threat is moderate but mitigatable by applying the vendor patch or recommended workarounds.