Server-Side Request Forgery in Next.js rewrites via attacker-controlled hostname (CVE-2026-64645)

A vulnerability in Next.js allows rewrites() or redirects() rules that construct their external destination hostname from request-controlled input to be redirected to an arbitrary hostname, bypassing the configured hostname suffix. For rewrite rules, Next.js proxies the request to the attacker-chosen host and returns the response from the application's origin, constituting Server-Side Request Forgery. Redirects rules configured in this manner are vulnerable to Open Redirect attacks. Affected versions: - >= 12.0.0 < 15.5.21 - >= 16.0.0 < 16.2.11 We recommend updating to: 15.5.21, 16.2.11. CVSS 8.3 · our assessment: this_week Reference: https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4 Details: https://vuln.today/cve/CVE-2026-64645