A vulnerable range of Next.js releases allows an attacker to retrieve internal server function identifiers, such as Server Action IDs, without authentication. This disclosure provides an attacker with valuable enumerated endpoints that were previously protected, potentially enabling further reconnaissance or exploitation of other application weaknesses. The flaw originates from publicly served client artifacts—static chunks that embed references to these actions—so the attack can be performed entirely from an unauthenticated client without privilege escalation.

The problem affects Next.js applications built with the App Router and Server Actions or use cache endpoints, specifically versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. These vulnerable releases are distributed under the vercel:next.js product. Upgrading to version 15.5.21 or later, or to 16.2.11 or later, removes the vulnerability.

The CVSS score of 6.3 indicates moderate severity; the exploit does not require additional credentials or specialized conditions, making it easily achievable by anyone with network access to the application. The EPSS score is < 1%, indicating a very low likelihood of exploitation, but the lack of listing in CISA’s KEV catalog suggests no known widespread exploitation yet. Attackers can discover the flaw simply by accessing publicly served static assets, so the primary vector is unauthenticated over the web.