This vulnerability (CVE-2026-64645) affects Next.js rewrites() and redirects() configuration when the destination hostname is dynamically built from user-controlled input. An attacker can manipulate the hostname to point to arbitrary external hosts. For rewrites, Next.js proxies the request to the attacker-controlled host and returns the response as if from the application origin, enabling SSRF. For redirects, the attacker can cause an open redirect to arbitrary URLs. The vulnerability occurs regardless of the hostname suffix specified in the rule. Examples include dynamic subdomains derived from path parameters or query parameters without proper validation.

An attacker can exploit this vulnerability to perform Server-Side Request Forgery (SSRF) via rewrites, potentially accessing internal or protected network resources through the Next.js server. Additionally, redirects configured this way are vulnerable to open redirect attacks, which can be used for phishing or redirecting users to malicious sites. The vulnerability affects applications that use dynamic hostnames in rewrites or redirects without restricting user input to safe characters.

No official patch or fix is currently confirmed. Users should avoid building the hostname of external rewrites() or redirects() destinations directly from user-controlled input. If dynamic subdomains are necessary, constrain the dynamic segment to hostname-safe characters, for example by using a regex like '(?<region>[a-z0-9-]+)'. Monitor the vendor advisory for updates and apply official fixes once available.