{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/next.js--15.5.21/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Next.js 12.x","Next.js 13.x","Next.js 14.x","Next.js 15.x","Next.js 16.x","Next.js (\u003c 15.5.21)","Next.js (\u003c 16.2.11)"],"_cs_severities":["high"],"_cs_tags":["ssrf","open-redirect","next.js","web-vulnerability","cve"],"_cs_type":"advisory","_cs_vendors":["Vercel"],"content_html":"\u003cp\u003eA high-severity vulnerability, CVE-2026-64645, has been identified in the Next.js framework, affecting versions from 12.0.0 up to 15.5.20 and from 16.0.0 up to 16.2.10. This flaw allows for Server-Side Request Forgery (SSRF) and Open Redirect when an application's \u003ccode\u003enext.config.js\u003c/code\u003e file contains \u003ccode\u003erewrites()\u003c/code\u003e or \u003ccode\u003eredirects()\u003c/code\u003e rules that construct external destination hostnames using dynamic segments from request-controlled input. An attacker can craft a malicious HTTP request that injects an arbitrary hostname or URL into these dynamic segments, regardless of any intended hostname suffix configured in the rule. This manipulation causes the Next.js application to either proxy requests to an attacker-specified internal or external host (SSRF), or redirect users to a malicious external site (Open Redirect). The vulnerability poses a significant risk for unauthorized access to internal systems, data exfiltration, or successful phishing campaigns.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a Next.js application using vulnerable \u003ccode\u003erewrites()\u003c/code\u003e or \u003ccode\u003eredirects()\u003c/code\u003e rules that derive external destination hostnames from untrusted user input (e.g., path segments like \u003ccode\u003e/:tenant\u003c/code\u003e or query parameters like \u003ccode\u003e?region=\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request by inserting an arbitrary hostname, IP address, or full URL (e.g., \u003ccode\u003ehttp://internal-service.com/api\u003c/code\u003e or \u003ccode\u003e192.168.1.1/admin\u003c/code\u003e) into the dynamic segment of the request path or query parameter.\u003c/li\u003e\n\u003cli\u003eThe Next.js application, processing the request, substitutes the attacker-controlled input into the \u003ccode\u003edestination\u003c/code\u003e field of the \u003ccode\u003enext.config.js\u003c/code\u003e rewrite or redirect rule without proper sanitization.\u003c/li\u003e\n\u003cli\u003eFor a \u003ccode\u003erewrites()\u003c/code\u003e rule, Next.js then proxies the request to the attacker-specified internal or external host (e.g., \u003ccode\u003ehttps://attacker-controlled.api.example.com\u003c/code\u003e or \u003ccode\u003ehttp://internal-service.com/api.api.example.com\u003c/code\u003e), sending the response back to the client. This constitutes a Server-Side Request Forgery (SSRF).\u003c/li\u003e\n\u003cli\u003eFor a \u003ccode\u003eredirects()\u003c/code\u003e rule, Next.js generates an HTTP 30x redirect response, pointing the user's browser to the attacker-specified external URL (e.g., \u003ccode\u003ehttps://attacker.com/phish\u003c/code\u003e). This leads to an Open Redirect.\u003c/li\u003e\n\u003cli\u003eSuccessful exploitation via SSRF allows the attacker to access internal network resources, bypass firewall rules, or scan internal networks. Successful exploitation via Open Redirect can be used for phishing attacks, credential theft, or malware distribution by redirecting unsuspecting users to malicious websites.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eIf successfully exploited, CVE-2026-64645 can lead to severe consequences, including unauthorized access to an organization's internal network infrastructure. Attackers can leverage Server-Side Request Forgery (SSRF) to scan internal networks, interact with otherwise inaccessible internal services, or bypass network segmentation to exfiltrate sensitive data. In the case of an Open Redirect, users can be redirected to arbitrary malicious websites, facilitating phishing campaigns for credential theft, malware delivery, or other social engineering attacks. The exact number of affected organizations is unknown, but any Next.js application using the vulnerable rewrite/redirect configurations in the specified versions is at risk, across all sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all affected Next.js instances to patched versions: Next.js 15.5.21 or later, or Next.js 16.2.11 or later to remediate CVE-2026-64645.\u003c/li\u003e\n\u003cli\u003eAs an immediate workaround for CVE-2026-64645, modify your \u003ccode\u003enext.config.js\u003c/code\u003e to ensure that any \u003ccode\u003erewrites()\u003c/code\u003e or \u003ccode\u003eredirects()\u003c/code\u003e rules do not construct the hostname of an external destination from untrusted user-controlled input.\u003c/li\u003e\n\u003cli\u003eIf dynamic subdomains are required, constrain the input value using regular expressions to allow only hostname-safe characters (e.g., \u003ccode\u003evalue: '(?\u0026lt;region\u0026gt;[a-z0-9-]+)'\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM and monitor for HTTP requests containing URL-forming characters in dynamic path segments or query parameters, as these may indicate attempted exploitation of CVE-2026-64645.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T23:12:01Z","date_published":"2026-07-22T23:03:56Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-ssrf-open-redirect/","summary":"A vulnerability (CVE-2026-64645) in Next.js allows Server-Side Request Forgery (SSRF) and Open Redirect when `rewrites()` or `redirects()` rules in `next.config.js` use attacker-controlled input to construct external destination hostnames, enabling attackers to manipulate dynamic segments from the path or `has` captures to point the rewrite to an arbitrary hostname, potentially leading to internal network access, information disclosure, or redirection of users to malicious sites, affecting Next.js versions from 12.0.0 up to, but not including, 15.5.21, and versions from 16.0.0 up to, but not including, 16.2.11.","title":"Next.js Server-Side Request Forgery and Open Redirect Vulnerability (CVE-2026-64645)","url":"https://feed.craftedsignal.io/briefs/2026-07-nextjs-ssrf-open-redirect/"}],"language":"en","title":"CraftedSignal Threat Feed - Next.js (\u003c 15.5.21)","version":"https://jsonfeed.org/version/1.1"}