UpHeron
All vulnerabilities

npm

CVE-2026-64645

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Severity
High
Published
22 Jul 2026
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.21, 16.2.11
Also known as
GHSA-p9j2-gv94-2wf4
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 12.0.0 before 15.5.21
  • From 16.0.0 before 16.2.11

References