Executive Intelligence Brief

A critical vulnerability (CVE-2026-64645) with a CVSS score of 8.3 has been discovered in Next.js, affecting versions >= 12.0.0 and < 15.5.21, as well as versions >= 16.0.0 and < 16.2.11. This vulnerability allows for Server-Side Request Forgery (SSRF) in rewrites via attacker-controlled destination hostnames. If exploited, an attacker could potentially forge requests to arbitrary hostnames, leading to SSRF or Open Redirect vulnerabilities. Immediate patching to versions 15.5.21 or 16.2.11 is recommended. If patching is not feasible, workarounds such as constraining dynamic subdomains to hostname-safe characters are advised.

Threat Overview

Next.js is a popular React-based framework for building server-rendered, statically generated, and performance-optimized web applications. It is widely used for building modern web applications, including server-rendered and statically generated sites. The vulnerability affects the `rewrites()` and `redirects()` features in Next.js, which allow developers to map client-side routes to server-side routes or external URLs.

Technical Deep Dive

Vulnerability Classification

The vulnerability is classified as CWE-918, Server-Side Request Forgery (SSRF). SSRF occurs when an attacker can manipulate server-side code to make requests to arbitrary hostnames or IP addresses, often leading to unauthorized access or data breaches.

Root Cause Analysis

The root cause of this vulnerability lies in the way Next.js handles dynamic segments in the hostname of `rewrites()` or `redirects()` destinations. When the destination hostname is built from request-controlled input, an attacker can manipulate the input to point to an arbitrary hostname. This allows an attacker to forge requests to external services or internal systems, potentially leading to SSRF or Open Redirect vulnerabilities.

Attack Vector & Chain

The attack vector involves an attacker manipulating the input to a `rewrites()` or `redirects()` rule to point to an arbitrary hostname. This can be done by crafting a request with a malicious hostname, which is then processed by the Next.js server. The attack chain involves the following steps:

  • Initial Access: The attacker sends a crafted request to the vulnerable Next.js application.
  • Weaponization: The attacker manipulates the request input to point to an arbitrary hostname.
  • Delivery & Exploitation: The Next.js server processes the request and proxies it to the arbitrary hostname, potentially leading to SSRF or Open Redirect vulnerabilities.

Exploitation Scenario Walkthrough

Scenario: SSRF via Malicious Rewrite Rule

  • Reconnaissance: An attacker discovers a vulnerable Next.js application with a `rewrites()` rule that builds its external destination hostname from request-controlled input.
  • Weaponization: The attacker crafts a request with a malicious hostname, pointing to an internal service or external URL.
  • Delivery & Exploitation: The attacker sends the crafted request to the vulnerable Next.js application, which proxies the request to the arbitrary hostname, potentially leading to SSRF or Open Redirect vulnerabilities.
  • Post-Exploitation: The attacker could potentially access internal services, exfiltrate data, or perform further malicious activities.
  • Impact Realization: The attacker achieves SSRF or Open Redirect vulnerabilities, potentially leading to unauthorized access or data breaches.

Exploitation in the Wild

The vulnerability is not currently being actively exploited in the wild. However, given its severity and potential impact, it is essential to patch or apply workarounds immediately.

Impact Analysis

Direct Impact

The direct impact of this vulnerability is the potential for SSRF or Open Redirect vulnerabilities, which could lead to unauthorized access, data breaches, or further malicious activities.

Downstream & Cascading Effects

The downstream and cascading effects of this vulnerability could include:

  • Supply chain risk: If the vulnerable Next.js application is used in a supply chain, an attacker could potentially exploit the vulnerability to access sensitive data or disrupt operations.
  • Regulatory implications: Depending on the nature of the data being processed, an exploit could lead to regulatory issues or fines.
  • Customer data exposure: If the vulnerable application processes sensitive customer data, an exploit could lead to data breaches or exposure.

Affected Products & Versions

The vulnerability affects Next.js versions >= 12.0.0 and < 15.5.21, as well as versions >= 16.0.0 and < 16.2.11. The fixed versions are 15.5.21 and 16.2.11.

Detection & Threat Hunting

Indicators of Compromise

Indicators of compromise may include:

  • Unusual traffic patterns or requests to external services or internal systems.
  • Logs indicating requests to arbitrary hostnames or IP addresses.

Detection Rules & Signatures

Detection rules and signatures may include:

  • Monitoring for requests to external services or internal systems.
  • Analyzing logs for requests with malicious hostnames or IP addresses.

Threat Hunting Queries

Threat hunting queries may include:

  • Searching logs for requests with suspicious hostnames or IP addresses.
  • Analyzing traffic patterns for unusual requests to external services or internal systems.

Remediation & Hardening

Immediate Actions (0-24 hours)

Immediate actions include:

  • Patching to versions 15.5.21 or 16.2.11.
  • Applying workarounds such as constraining dynamic subdomains to hostname-safe characters.

Short-Term Hardening (1-7 days)

Short-term hardening measures include:

  • Implementing network segmentation or access controls to limit the scope of the vulnerability.
  • Enhancing monitoring and logging to detect potential exploits.

Strategic Recommendations

Strategic recommendations include:

  • Regularly updating and patching dependencies, including Next.js.
  • Implementing secure coding practices to prevent similar vulnerabilities.

Analyst Assessment

The vulnerability has a high severity score of 8.3 and could potentially lead to significant impacts if exploited. Given its severity and potential impact, it is essential to patch or apply workarounds immediately. The likelihood of exploitation is currently low, but it is expected to increase as more information becomes publicly available.

Sources