CVE-2026-64645

Published: Lug 27, 2026 Last Modified: Lug 27, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,3
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a
rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

601

URL Redirection to Untrusted Site ('Open Redirect')

Draft
Common Consequences
Security Scopes Affected:
Access Control Confidentiality Other
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity Other
Applicable Platforms
Technologies: Web Based, Web Server
View CWE Details
918

Server-Side Request Forgery (SSRF)

Incomplete
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control
Potential Impacts:
Read Application Data Execute Unauthorized Code Or Commands Bypass Protection Mechanism
Applicable Platforms
Technologies: Web Based, AI/ML, Web Server
View CWE Details
https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707…
https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c5…
https://github.com/vercel/next.js/releases/tag/v15.5.21
https://github.com/vercel/next.js/releases/tag/v16.2.11
https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4