CVE-2026-64645

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

At a glance

Severity: HIGH 8.3
EPSS: EPSS 0.41 % · percentile 35 (2026-10-27)
State: PUBLISHED
Published: 2026-07-27
Updated: 2026-07-28
Assigner: GitHub_M
NVD status: Analyzed

Description

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

Scores

Version	Score	Vector	Scored by
CVSS 4.0	HIGH 8.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N	GitHub_M
CVSS 4.0	HIGH 8.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

Advisories

GHSA-p9j2-gv94-2wf4 — Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

European references

ENISA EUVD · EUVD-2026-49378
GCVE · GCVE-0-2026-64645

CERT-FR advisories

CERTFR-2026-AVI-1291 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1256 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 12.0.0 < 15.5.21
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 16.0.0 < 16.2.11

Affected products

Product	Versions
vercel · next.js	affected >= 12.0.0 < 15.5.21 ; affected >= 16.0.0, < 16.2.11

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD