CVE-2026-64645

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10

Description Rules configured via rewrites() or redirects() that construct an external destination hostname using request-controlled input can be manipulated to point to an arbitrary hostname, bypassing the intended hostname suffix. When a rewrite is used, the application proxies the request to the arbitrary host and returns the response from its own origin, resulting in Server-Side Request Forgery (SSRF), a vulnerability where an attacker induces the server to make requests to an unintended location. When a redirect is used, it leads to an Open Redirect. This occurs when dynamic segments are placed in the hostname, whether derived from the path or a has capture.

Recommendations Update versions 12.0.0 through 15.5.20 to version 15.5.21. Update versions 16.0.0 through 16.2.10 to version 16.2.11. Avoid building the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the input value to hostname-safe characters using a regular expression such as (?<region>[a-z0-9-]+).