CVE-2026-64645: Vercel Next.js SSRF Vulnerability

CVE-2026-64645 Overview

CVE-2026-64645 is a high-severity vulnerability in Vercel Next.js affecting rewrites() and redirects() configurations. When a rule builds its external destination hostname from request-controlled input, an attacker can point the destination at an arbitrary hostname regardless of the rule's declared hostname suffix. A vulnerable rewrites() rule causes the Next.js server to proxy the request to the attacker-chosen host and return the response through the application's origin, producing Server-Side Request Forgery (SSRF). A redirects() rule configured the same way becomes an Open Redirect [CWE-601]. The flaw affects versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, and is fixed in 15.5.21 and 16.2.11.

Critical Impact
Unauthenticated attackers can coerce Next.js to proxy requests to arbitrary internal or external hosts, exposing internal services and enabling phishing via trusted origin redirects.

Affected Products

Vercel Next.js versions 12.0.0 through 15.5.20
Vercel Next.js versions 16.0.0 through 16.2.10
Applications using rewrites() or redirects() with request-derived destination hostnames

Discovery Timeline

2026-07-27 - CVE-2026-64645 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64645

Vulnerability Analysis

Next.js allows developers to declare route rules through rewrites() and redirects() in next.config.js. Each rule specifies a source path pattern and a destination, which may include dynamic parameters captured from the incoming request. The router substitutes these parameters into the destination URL before proxying or redirecting.

The vulnerable path resides in packages/next/src/server/lib/router-utils/proxy-request.ts, where the destination URL is constructed with url.format(parsedUrl) and passed to http-proxy without validating that the resulting hostname matches the configured suffix. When developers embed a captured parameter such as :host inside the destination hostname, an attacker crafts a request that produces a WHATWG URL parse resolving to a completely different host. Because http-proxy does not re-validate the target, Next.js forwards the request to the attacker-chosen origin and streams the response back to the client. For redirect rules, the same substitution yields a Location header pointing off-origin.

Root Cause

The root cause is missing hostname validation after parameter interpolation. The router trusts that the declared hostname suffix constrains the final destination, but exotic parameter values, including embedded credentials, ports, or backslashes, cause the parsed URL's hostname to diverge from the string-level suffix check.

Attack Vector

Exploitation requires only a network-reachable Next.js application with a vulnerable rewrite or redirect rule. The attacker submits a request whose path or query populates the parameter used in the destination hostname. For SSRF, the attacker targets internal metadata services, cloud IMDS endpoints, or private administrative APIs. For Open Redirect, the attacker distributes a link to the trusted application that transparently redirects victims to an attacker-controlled site.

typescript

// Patched code in packages/next/src/server/lib/router-utils/proxy-request.ts
  parsedUrl.search = stringifyQuery(req as any, query)

  const target = url.format(parsedUrl)
  // Keep in mind that a WHATWG URL's hostname and the parsedUrl's hostname
  // are not strictly equal due to lowercasing, IDN translation, IPv4 and IPv6 normalization, etc.
  // We just make sure this is a valid URL since http-proxy doesn't validate.
  new URL(target)
  const HttpProxy =
    require('next/dist/compiled/http-proxy') as typeof import('next/dist/compiled/http-proxy')
// Source: [Next.js commit 35f5013](https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9)

The patch instantiates new URL(target) to force WHATWG URL parsing and adds error code 795 / 1146: Invalid target hostname "%s" for proxy request, expected "%s".

Detection Methods for CVE-2026-64645

Indicators of Compromise

Outbound proxy connections from the Next.js server to unexpected hostnames, private RFC1918 ranges, or cloud metadata addresses such as 169.254.169.254.
HTTP 3xx responses issued by the application with Location headers pointing to external domains not owned by the operator.
Error log entries referencing Invalid target hostname after upgrading, indicating attempted exploitation was blocked by the patch.

Detection Strategies

Audit next.config.js and framework routing files for rewrites() or redirects() entries whose destination hostname contains dynamic parameters like :host or :subdomain.
Inspect reverse-proxy and CDN access logs for anomalous upstream targets sourced from Next.js origin instances.
Correlate request parameters against outbound proxy destinations to identify attacker-controlled hostname injection.

Monitoring Recommendations

Enable egress filtering on Next.js server workloads and alert on connections to cloud metadata endpoints or internal management ranges.
Log and review all 3xx responses whose Location host differs from the configured application domains.
Instrument the http-proxy layer to record final resolved target hostnames for post-hoc review.

How to Mitigate CVE-2026-64645

Immediate Actions Required

Upgrade Next.js to 15.5.21 or 16.2.11 on all self-hosted deployments.
Inventory all rewrite and redirect rules and remove user-controlled parameters from destination hostnames until upgrades complete.
Restrict outbound network access from Next.js runtime environments to only required upstream services.

Patch Information

Vercel released fixes in Next.js v15.5.21 and Next.js v16.2.11. The changes are documented in the GHSA-p9j2-gv94-2wf4 advisory and applied via commits 35f5013 and d303326. Applications hosted on Vercel's managed platform receive the fix automatically.

Workarounds

Replace dynamic hostname parameters with a static allowlist of destination hosts hard-coded in the rewrite or redirect rule.
Implement middleware that validates the resolved destination hostname against an explicit allowlist before proxying.
Terminate rewrites at a hardened reverse proxy that enforces host validation independent of Next.js.

bash

# Upgrade to a patched release
npm install next@15.5.21
# or for the 16.x branch
npm install next@16.2.11

# Verify installed version
npx next --version