PT-2026-63560 · Npm · Next

CVE-2026-64645

·

Published

2026-07-22

·

Updated

2026-07-22

CVSS v4.0

8.3

High

VectorAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Impact

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect.
This affects any destination that puts a dynamic segment in the hostname, whether from the path:
javascript
// next.config.js
module.exports = {
 async rewrites() {
  return [
   {
    source: '/:tenant',
    destination: 'https://:tenant.api.example.com',
   },
  ]
 },
}
or from a has capture:
javascript
// next.config.js
module.exports = {
 async rewrites() {
  return [
   {
    source: '/',
    has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
    destination: 'https://:region.api.example.com',
   },
  ]
 },
}

Workarounds

If you cannot upgrade immediately, do not build the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: value: '(?<region>[a-z0-9-]+)'.

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-64645
GHSA-P9J2-GV94-2WF4

Affected Products

Next