CVE-2026-64645
1 advisory.
npm/next CVE-2026-64645: high
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Action: Upgrade next to 15.5.21 or later.
npm i next@15.5.21npm i next@16.2.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.0.0 | 15.5.21 | - |
| 16.0.0 | 16.2.11 | - |
Fixed versions
| 15.5.21 | 16.2.11 |
Sources
- osv: GHSA-p9j2-gv94-2wf4
- https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4
- https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9
- https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
CVE-2026-64645 · published · modified · JSON