Skip to main content

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2026-64645

High
8.3/10

Summary

A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request Forgery. A `redirects()` rule configured this way is vulnerable to an Open Redirect. Affected versions are from 12.0.0 prior to 15.5.21 and from 16.0.0 prior to 16.2.11.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-601 - Open Redirect

An open redirect attack employs a URL parameter, HTML refresh tags, or a DOM based location change to exploit the trust of a vulnerable domain to direct the users to a malicious website. The attack could lead to higher severity vulnerabilities such as unauthorized access control, account takeover, XSS, and more.

References

Advisory Timeline

  • Published