CVE-2026-64645

A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) or Open Redirect attacks. When a rewrites() or redirects() rule constructs an external destination hostname using attacker-controlled input, the application can be coerced into proxying requests to arbitrary hosts, leading to SSRF. Additionally, this misconfiguration can result in Open Redirects, potentially exposing users to phishing.

This Important vulnerability in Next.js applications arises when rewrites() or redirects() rules construct external destination hostnames from untrusted input. An attacker could exploit this to perform Server-Side Request Forgery (SSRF), potentially accessing internal network resources, or to facilitate Open Redirect attacks, leading to user redirection to malicious sites. The impact is contingent on the application's specific routing configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.