Vercel Next.js up to 15.5.20/16.0.0-16.2.10 rewrites/redirects server-side request forgery

Summaryinfo

A vulnerability was found in Vercel Next.js up to 15.5.20/16.0.0-16.2.10. It has been declared as critical. Affected is the function rewrites/redirects. Executing a manipulation can lead to server-side request forgery. This vulnerability is handled as CVE-2026-64645. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Vercel Next.js up to 15.5.20/16.0.0-16.2.10. This vulnerability affects the function rewrites/redirects. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-64645 since 07/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 330090 (Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 15.5.21 or 16.2.11 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (330090). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• JavaScript Library

Vendor

• Vercel

Name

• Next.js

Version

• 15.5.0
• 15.5.1
• 15.5.2
• 15.5.3
• 15.5.4
• 15.5.5
• 15.5.6
• 15.5.7
• 15.5.8
• 15.5.9
• 15.5.10
• 15.5.11
• 15.5.12
• 15.5.13
• 15.5.14
• 15.5.15
• 15.5.16
• 15.5.17
• 15.5.18
• 15.5.19
• 15.5.20
• 16.0.0-16.2.0
• 16.0.0-16.2.1
• 16.0.0-16.2.2
• 16.0.0-16.2.3
• 16.0.0-16.2.4
• 16.0.0-16.2.5
• 16.0.0-16.2.6
• 16.0.0-16.2.7
• 16.0.0-16.2.8
• 16.0.0-16.2.9
• 16.0.0-16.2.10

Website

• Product: https://github.com/vercel/next.js/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion