CVE-2026-64645 vercel CVE debrief

Who should care

Developers and administrators using Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10 should be aware of this vulnerability and take immediate action to update to a patched version. Additionally, security teams and vulnerability managers should prioritize this CVE for potential exploitation attempts.

Technical summary

The vulnerability arises from the rewrites() and redirects() features in Next.js. When these features are used to build external destination hostnames from request-controlled input, an attacker can manipulate the hostname to point to an arbitrary location. This can lead to SSRF, allowing attackers to access internal resources or services not intended to be exposed. In the case of redirects(), it can result in an Open Redirect, which can be used for phishing attacks or to bypass security measures. The fixes in versions 15.5.21 and 16.2.11 likely involve proper validation and sanitization of input when constructing hostnames for these features.

Defensive priority

High

Recommended defensive actions

• Update Next.js to version 15.5.21 or 16.2.11, whichever is applicable.
• Review and validate all rewrites() and redirects() rules to ensure they do not use request-controlled input to build hostnames.
• Implement additional security measures such as input validation and sanitization for hostname construction.
• Monitor for potential exploitation attempts and anomalous traffic patterns.
• Consider implementing compensating controls such as Web Application Firewalls (WAFs) to detect and prevent attacks.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability and its fixes. GitHub commits and release notes offer technical details about the patches. The advisory GHSA-p9j2-gv94-2wf4 likely contains additional context and recommendations for affected users.

Official resources