CVE-2026-64645
Received Received - Intake

Server-Side Request Forgery in Next.js Framework

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: GitHub, Inc.

Description
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64645
EUVD
EUVD-2026-49378

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
vercel next.js From 12.0.0 (inc) to 15.5.20 (inc)
vercel next.js From 16.0.0 (inc) to 16.2.10 (inc)
vercel next.js 15.5.21
vercel next.js 16.2.11
vercel next.js From 12.0.0 (inc) to 16.2.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. It occurs when rewrite() or redirects() rules use attacker-controlled input to build an external destination hostname, allowing arbitrary host specification. For rewrites, Next.js proxies requests to the malicious host, serving responses from the application's origin. For redirects, it enables Open Redirect attacks.

Detection Guidance

Check Next.js version with 'npm list next' or 'yarn list next'. If running versions 12.0.0-15.5.20 or 16.0.0-16.2.10, the system is vulnerable. Review rewrite/redirect rules in next.config.js for dynamic hostname construction using user input.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate data, or redirect users to malicious sites. The vulnerability allows SSRF, which may lead to unauthorized access to sensitive resources or Open Redirects, potentially enabling phishing attacks or further exploitation of trusted domains.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unauthorized access via SSRF may result in breaches of confidentiality, leading to regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade Next.js to version 15.5.21 or 16.2.11 or later. If upgrading is not possible, avoid constructing hostnames from user-controlled input in rewrite/redirect rules. Validate and sanitize all dynamic segments to ensure they only contain hostname-safe characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart