Junglewise Threat Intelligence

CVE-2026-64645: Vercel Next.js SSRF and Open Redirect in rewrites and redirects

CVE-2026-64645 · Severity: high · CVSS 8.3 · Published 2026-07-27

Executive brief

Next.js, a popular framework for building web applications, contains a vulnerability in how it handles URL redirection and internal routing rules. If an application is configured to determine its routing destination based on user input, an attacker can trick the server into visiting malicious websites or redirecting users to fraudulent pages. This could lead to the exposure of internal services or facilitate phishing attacks against users.

Technical details

A vulnerability exists in Next.js where the rewrites() and redirects() functions fail to properly validate or sanitize request-controlled input used to construct external destination hostnames. An attacker can provide a crafted input that overrides the intended hostname suffix, pointing the rule to an arbitrary domain. In the case of rewrites, Next.js proxies the request to the attacker-controlled host and serves the response from the application's origin, resulting in Server-Side Request Forgery (SSRF). In the case of redirects, it results in an Open Redirect. The issue is fixed in versions 15.5.21 and 16.2.11 by ensuring exotic rewrite parameter values are properly encoded and validated.

Affected products

  • Vercel Next.js 12.0.0 - 15.5.20, 16.0.0 - 16.2.10

Timeline

  • 2026-07-21: patched: Fixes released in versions 15.5.21 and 16.2.11
  • 2026-07-27: disclosed: CVE-2026-64645 published

References

Related threats