Which versions of Open Redirect are affected by CVE-2026-64645?

Next.js applications using versions 12.0.0-15.5.20 or 16.0.0-16.2.10 face a vulnerability enabling attackers to redirect internal requests to attacker-controlled hosts or send users to malicious…. A patch is available.

How to fix or mitigate CVE-2026-64645?

Within 24 hours, inventory all Next.js applications and identify those running affected versions 12.0.0-15.5.20 or 16.0.0-16.2.10, then audit next.config.js files for rewrites() or redirects() rules using dynamic path segments or query captures in destination hostnames. Within 7 days, upgrade to Next.js 15.5.21 or 16.2.11 (matching your major version in production) and validate rewrites and redirects functionality in staging environments. Within 30 days, complete production rollout of patches, analyze access logs for potential exploitation attempts, and establish code review controls to prevent similar misconfigurations of rewrites and redirects rules going forward.

Open Redirect CVE-2026-64645

Q: What is the CVSS score of CVE-2026-64645?

CVE-2026-64645 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-49378 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-22 https://github.com/vercel/next.js

GHSA-p9j2-gv94-2wf4

Open Redirect SSRF Red Hat

8.3

CVSS 4.0 · Vendor: https://github.com/vercel/next.js

Severity by source

Vendor (https://github.com/vercel/next.js) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Network-reachable with no auth or interaction against a vulnerable config; SSRF crosses into backend systems (S:C) exposing internal data (C:H) with limited integrity impact via forged proxied requests.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (https://github.com/vercel/next.js).

CVSS VectorVendor: https://github.com/vercel/next.js

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 27, 2026 - 18:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 27, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jul 27, 2026 - 18:22 NVD

8.3 (HIGH)

Source Code Evidence Fetched

Jul 22, 2026 - 23:31 vuln.today

Analysis Generated

Jul 22, 2026 - 23:31 vuln.today

CVE Published

Jul 22, 2026 - 23:02 cve.org

HIGH

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on next (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 12.0.0.

DescriptionCVE.org

Impact

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect.

This affects any destination that puts a dynamic segment in the hostname, whether from the path:

javascript

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/:tenant',
        destination: 'https://:tenant.api.example.com',
      },
    ]
  },
}

or from a has capture:

javascript

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/',
        has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
        destination: 'https://:region.api.example.com',
      },
    ]
  },
}

Workarounds

If you cannot upgrade immediately, do not build the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: value: '(?<region>[a-z0-9-]+)'.

AnalysisAI

Server-Side Request Forgery (SSRF) and open redirect in Next.js rewrite/redirect rules when the destination hostname is dynamically constructed from user-controlled input. Versions 12.0.0 to 15.5.20 and 16.0.0 to 16.2.10 are affected, allowing a remote attacker to proxy requests to arbitrary hosts or redirect users. Patched versions 15.5.21 and 16.2.11 are available; no active exploitation has been reported.