VulnSocial

CVE-2026-64645Patch(vercel / next.js)

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch vercel next.js systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

vercel CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-601CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • next.js

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • General: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-27); latest day: 2
  • 5 total mentions across 3 days

Affected systems

Vendors
vercel
Products
next.js

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-07-23: 1Mentions · 2026-07-27: 2Mentions · 2026-08-06: 2Patch / Workaround · 2026-07-23: 1Patch / Workaround · 2026-08-06: 2Technical Details · 2026-07-23: 1Technical Details · 2026-08-06: 207-2307-2708-06
Signal classification2 categories
Patch
360.0%
General
240.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-07-231
Patch1
2026-07-272
General2
2026-08-062
Patch2
Full discourse5 posts
  • HeroDevs@herodevs
    Patch

    Leave a gap in the outline and the fill goes everywhere. CVE-2026-64645: SSRF in Next.js rewrites() and redirects(). CVSS 8.3, no auth required.Affected: 12.0.0 → 16.x Patched: 15.5.21 · 16.2.11 No OSS patch for 12/13/14.NES ships the fix without the migration. 🎨#NextJS #SSRF #CVE

    Post summary

    The post announces the SSRF vulnerability CVE‑2026‑64645 affecting Next.js versions 12–16, details its severity, and lists the patched releases while noting the lack of OSS patches for older versions.

    10010189
    2.7K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Three Next.js vulnerabilities (CVE-2026-64645, CVE-2026-64649, CVE-2026-64642) enable Server-Side Request Forgery and middleware bypass. Patch now. #Nextjs #SSRF #CVE202664645 #WebSecurity #Vercel http://securityonline.info/nextjs-vulnerabilities-ssrf/

    Post summary

    Three newly disclosed Next.js SSRF vulnerabilities are highlighted, with an immediate patch notice and no indication of active exploitation or proof of concept.

    00010407
    12.6K followersView on X
  • HeroDevs@herodevs
    Patch

    🔗 https://www.herodevs.com/blog-posts/cve-2026-64645-next-js-ssrf-vulnerability-in-rewrites-and-redirects-explained-and-how-to-fix-it?utm_source=x-twitter&utm_medium=organic-social&utm_campaign=product-general_global&utm_content=post_none_20260806_a

    Post summary

    The blog post details a SSRF vulnerability in Next.js rewrites and redirects and provides remediation steps.

    0000080
    2.7K followersView on X
  • MalwareObserver@MalwareObserver
    General

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-64645](https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e... https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9 #Vulnerability #CVE #ZeroDay

    Post summary

    The tweet announces the existence of CVE-2026-64645 and links to a GitHub commit, but offers no further technical details or actionable information.

    0000041
    16 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-64645 Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rul… https://www.cve.org/CVERecord?id=CVE-2026-64645

    Post summary

    The text simply references CVE‑2026‑64645 with a link to its record, providing no further technical or operational details.

    00000969
    57.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appvercelnext.js-node.js-

Explore more

Back to dashboardvercel CVEsnext.js vulnerabilities