highnextCVE-2026-64645
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Affected versions
>= 12.0.0, < 15.5.21, fixed in 15.5.21>= 16.0.0, < 16.2.11, fixed in 16.2.11
Published 2026-07-22. Last checked 2026-11-01. Read the source advisory