CVE-2026-64645
Fixed in a distro release EPSS <1%CVSS 8.3
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.
Products: vercel next.js
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | next | 15.5.21 |
| npm | next | 16.2.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cadence-web | no fix |
| Chainguard | commercial-chainloop-frontend | no fix |
| Chainguard | homepage | 1.13.2-r8 |
| Chainguard | homepage | 1.13.2-r9 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r30 |
| Chainguard | keep-ui | 0.54.2-r1 |
| Chainguard | keep-ui-fips | 0.54.2-r1 |
| Chainguard | langfuse-2 | 2.95.12-r35 |
| Chainguard | langfuse-3 | 3.224.1-r0 |
| Chainguard | langfuse-3-compat | 3.225.7-r6 |
| Chainguard | langfuse-3-worker | 3.224.1-r0 |
| Chainguard | langfuse-fips-2 | 2.95.12-r38 |
| Chainguard | langfuse-fips-3 | 3.224.1-r0 |
| Chainguard | langfuse-fips-3-worker | 3.224.1-r0 |
| Chainguard | peerdb-ui | 0.37.3-r1 |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r30 |
| Wolfi | langfuse-3 | 3.224.1-r0 |
| Wolfi | langfuse-3-compat | 3.225.7-r6 |
| Wolfi | langfuse-3-worker | 3.224.1-r0 |