CVE-2026-64645: Vercel Next.js SSRF and Open Redirect in rewrites and redirects

CVE-2026-64645 · Severity: high · CVSS 4 · Published 2026-07-27

Next.js, a popular framework for building web applications, contains a vulnerability in how it handles URL redirection and internal routing rules. If an application is configured to determine its routing destination based on user input, an attacker can trick the server into visiting malicious websites or redirecting users to fraudulent pages. This could lead to the exposure of internal services or facilitate phishing attacks against users.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-64645 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-64645 being exploited in the wild.
How severe is CVE-2026-64645?
High severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?
next (npm) SEMVER:introduced=12.0.0,fixed=15.5.21; Vercel Next.js >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11, 12.0.0 - 15.5.20, 16.0.0 - 16.2.10.
Is there a fix for CVE-2026-64645?
Yes. next (npm): upgrade to 15.5.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64645 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-64645?
Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next (npm): upgrade to 15.5.21 or later
    npm install next@15.5.21

Technical details

A vulnerability exists in Next.js where the rewrites() and redirects() functions fail to properly validate or sanitize request-controlled input used to construct external destination hostnames. An attacker can provide a crafted input that overrides the intended hostname suffix, pointing the rule to an arbitrary domain. In the case of rewrites, Next.js proxies the request to the attacker-controlled host and serves the response from the application's origin, resulting in Server-Side Request Forgery (SSRF). In the case of redirects, it results in an Open Redirect. The issue is fixed in versions 15.5.21 and 16.2.11 by ensuring exotic rewrite parameter values are properly encoded and validated.

Affected products

  • Vercel Next.js 12.0.0 - 15.5.20, 16.0.0 - 16.2.10

Identifiers

  • CVE-2026-64645
  • GHSA-p9j2-gv94-2wf4

Timeline

  • 2026-07-21: patched: Fixes released in versions 15.5.21 and 16.2.11
  • 2026-07-27: disclosed: CVE-2026-64645 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.