CVE-2026-64645
Severity CVSS v4.0:
HIGH
Type:
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
Publication date:
27/07/2026
Last modified:
29/07/2026
Description
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a<br />
rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule&#39;s hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application&#39;s origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.
Impact
Base Score 4.0
8.30
Severity 4.0
HIGH
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | 12.0.0 (including) | 15.5.21 (excluding) |
| cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* | 16.0.0 (including) | 16.2.11 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9
- https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
- https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4