CVE-2026-64645 Details
Description
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.
A server-side request forgery (SSRF) vulnerability has been identified in Next.js, a popular React framework, specifically in versions 12.0.0 prior to 15.5.21 and 16.0.0 prior to 16.2.11. The issue arises when a 'rewrites()' or 'redirects()' rule constructs its external destination hostname from user-controlled input. This can be directed to an arbitrary hostname, bypassing the rule's hostname suffix restriction. In the case of a rewrite, Next.js proxies the request to the chosen host and delivers the response from the application's origin, creating an SSRF vulnerability. Similarly, a 'redirects()' rule set up in this manner is susceptible to an open redirect.
Users can upgrade to Next.js versions 15.5.21 or 16.2.11, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 12.0.0, < 15.5.21 >= 16.0.0, < 16.2.11 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | Initial Analysis | [email protected] |
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |