Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) or Open Redirect attacks. When a `rewrites()` or `redirects()` rule constructs an external destination hostname using attacker-controlled input, the application can be coerced into proxying requests to arbitrary hosts, leading to SSRF. Additionally, this misconfiguration can result in Open Redirects, potentially exposing users to phishing.

This Important vulnerability in Next.js applications arises when `rewrites()` or `redirects()` rules construct external destination hostnames from untrusted input. An attacker could exploit this to perform Server-Side Request Forgery (SSRF), potentially accessing internal network resources, or to facilitate Open Redirect attacks, leading to user redirection to malicious sites. The impact is contingent on the application's specific routing configuration. Red Hat Enterprise Linux 10 Affected firefox Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 7 Affected firefox Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected firefox Red Hat Enterprise Linux 9 Affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Trusted Artifact Signer Not affected rhtas/rekor-search-ui-rhel9 streams for Apache Kafka 2 Affected next streams for Apache Kafka 3 Affected next https://www.cve.org/CVERecord?id=CVE-2026-64645 https://nvd.nist.gov/vuln/detail/CVE-2026-64645 https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9 https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599 https://github.com/vercel/next.js/releases/tag/v15.5.21 https://github.com/vercel/next.js/releases/tag/v16.2.11 https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4