CVE-2026-64645: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule’s hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application’s origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect.

This affects any destination that puts a dynamic segment in the hostname, whether from the path:

// next.config.js
module.exports = {
async rewrites() {
return [
{
source: '/:tenant',
destination: 'https://:tenant.api.example.com',
},
]
},
}

or from a has capture:

// next.config.js
module.exports = {
async rewrites() {
return [
{
source: '/',
has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
destination: 'https://:region.api.example.com',
},
]
},
}