Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20
    and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname
    from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname
    suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the
    application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is
    vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.
    (CVE-2026-64645)

The Next.js Framework on the remote host is affected by a server-side request forgery vulnerability:

  - A rewrites() or redirects() rule that builds its external destination hostname from request-controlled     input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite,     Next.js proxies the request to that arbitrary host and serves the response from the application's origin,     leading to Server-Side Request Forgery. A redirects() rule configured this way is vulnerable to an Open     Redirect. (CVE-2026-64645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
460602	Echo: next: security update to 15.5.21	Tenable Cloud Security	Echo Local Security Checks	Local	high
460602	Echo: next: security update to 15.5.21	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
330090	Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF	Nessus	Misc.	Local	high
445136	SCA: security update for next (GHSA-p9j2-gv94-2wf4)	Tenable Cloud Security	SCA Checks	Local	high
445136	SCA: security update for next (GHSA-p9j2-gv94-2wf4)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-64645

high

Tenable Plugins

high

high

high

high

high