Next.js, a React framework, is vulnerable to SSRF and open redirect attacks in versions >=12.0.0 <15.5.21 and >=16.0.0 <16.2.11. The vulnerability arises when rewrites() or redirects() rules build external destination hostnames from request-controlled input, bypassing hostname suffix restrictions. For rewrites, the server proxies requests to attacker-controlled hosts and returns the response, enabling SSRF. Redirects configured similarly allow open redirects. These vulnerabilities have been addressed in Next.js versions 15.5.21 and 16.2.11.

An attacker can exploit this vulnerability to make the Next.js server send requests to arbitrary hosts, potentially accessing internal resources or services not directly reachable by the attacker (SSRF). Additionally, open redirect vulnerabilities can facilitate phishing or redirect users to malicious sites. The CVSS 4.0 score is 8.3 (high severity), indicating significant risk if exploited.

Upgrade Next.js to version 15.5.21 or later in the 15.x series, or 16.2.11 or later in the 16.x series, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in these versions.