{"action":"Upgrade next to 15.5.21 or later.","affected":[{"fixed":"15.5.21","introduced":"12.0.0"},{"fixed":"16.2.11","introduced":"16.0.0"}],"component":"next","cve_ids":["CVE-2026-64645"],"ecosystem":"npm","epss":0.00414,"exploited":false,"fixed_versions":["15.5.21","16.2.11"],"ghsa_id":"GHSA-p9j2-gv94-2wf4","id":"tcs_01M5KG36X1AMWA6WYYMVH315JK","modified_at":"2026-09-10T03:51:11.554671163Z","published_at":"2026-07-22T23:02:23Z","references":["https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4","https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4","https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9","https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v15.5.21","https://github.com/vercel/next.js/releases/tag/v16.2.11"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-p9j2-gv94-2wf4","url":"https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4"}],"summary":"Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname"}