CVE-2026-64645

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23870.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

Impact

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect.

This affects any destination that puts a dynamic segment in the hostname, whether from the path:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/:tenant',
        destination: 'https://:tenant.api.example.com',
      },
    ]
  },
}

or from a has capture:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/',
        has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
        destination: 'https://:region.api.example.com',
      },
    ]
  },
}

Workarounds

If you cannot upgrade immediately, do not build the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: value: '(?<region>[a-z0-9-]+)'.

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this changelog.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.

TuxCare rebuilt 11 packages to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt 13 packages to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt 9 packages to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.

TuxCare rebuilt create-next-app to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/eslint-plugin-next to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/eslint-plugin-next to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/bundle-analyzer to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/bundle-analyzer to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/bundle-analyzer to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/plugin-storybook to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/plugin-storybook to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/plugin-storybook to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/polyfill-module to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/polyfill-module to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/polyfill-module to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/polyfill-nomodule to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/polyfill-nomodule to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/polyfill-nomodule to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/react-refresh-utils to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/react-refresh-utils to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/react-refresh-utils to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/third-parties to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/third-parties to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/swc-linux-x64-gnu to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.

TuxCare rebuilt @next/codemod to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/codemod to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/codemod to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/mdx to address 2 CVEs. Fixed in 12.3.7-tuxcare.8.

TuxCare rebuilt @next/mdx to address 13 CVEs. Fixed in 13.5.11-tuxcare.14.

TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 14.2.35-tuxcare.8.

TuxCare rebuilt @next/swc-linux-arm64-gnu to address 28 CVEs. Fixed in 15.1.2-tuxcare.2.

Root has patched CVE-2026-64645 in the next package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available.