onyx --cves cve-2026-64645
CVE-2026-64645
- score
- 0.1
- cvss
- 6.1
- epss
- 0.4%
- published
- 2026-07-27
- kev added
- —
- first seen
Next.js 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10 contain a server-side request forgery and open redirect caused by rewrites() or redirects() rules building external destination hostnames from request-controlled input, letting attackers perform SSRF or open redirect attacks, exploit requires crafted request with manipulated hostname input.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9
- https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
- https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4