# CVE-2026-64645: Vercel Next.js SSRF and Open Redirect in rewrites and redirects

Source: https://junglewise.ai/threats/cve-2026-64645-vercel-next-js-ssrf-and-open-redirect-in-rewrites-and-redirects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-64645 · Severity: high · CVSS 4 · Published 2026-07-27

Next.js, a popular framework for building web applications, contains a vulnerability in how it handles URL redirection and internal routing rules. If an application is configured to determine its routing destination based on user input, an attacker can trick the server into visiting malicious websites or redirecting users to fraudulent pages. This could lead to the exposure of internal services or facilitate phishing attacks against users.

Technologies: [next (npm)](https://junglewise.ai/threats/technologies/npm-next), [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-64645 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64645 being exploited in the wild.

**How severe is CVE-2026-64645?** High severity, with a CVSS score of 4, published 27 July 2026.

**Which products and versions are affected?** next (npm) SEMVER:introduced=12.0.0,fixed=15.5.21; Vercel Next.js >= 12.0.0, < 15.5.21; >= 16.0.0, < 16.2.11, 12.0.0 - 15.5.20, 16.0.0 - 16.2.10.

**Is there a fix for CVE-2026-64645?** Yes. next (npm): upgrade to 15.5.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64645 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-64645?** Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next (npm): upgrade to 15.5.21 or later

  ```sh
  npm install next@15.5.21
  ```


## Technical details

A vulnerability exists in Next.js where the rewrites() and redirects() functions fail to properly validate or sanitize request-controlled input used to construct external destination hostnames. An attacker can provide a crafted input that overrides the intended hostname suffix, pointing the rule to an arbitrary domain. In the case of rewrites, Next.js proxies the request to the attacker-controlled host and serves the response from the application's origin, resulting in Server-Side Request Forgery (SSRF). In the case of redirects, it results in an Open Redirect. The issue is fixed in versions 15.5.21 and 16.2.11 by ensuring exotic rewrite parameter values are properly encoded and validated.

## Affected products

- Vercel Next.js 12.0.0 - 15.5.20, 16.0.0 - 16.2.10

## Identifiers

- CVE-2026-64645
- GHSA-p9j2-gv94-2wf4

## Timeline

- 2026-07-21: patched: Fixes released in versions 15.5.21 and 16.2.11
- 2026-07-27: disclosed: CVE-2026-64645 published

## References

- [https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9](https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9)
- [https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599](https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4](https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)