Threats Tagged 'cve-2026-64645'
View all threats tagged with 'cve-2026-64645'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-64645'
Click on any threat for detailed analysis and mitigation recommendations
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (CVE-2026-64645)CVE-2026-64645 0 Next.js versions 12.0.0 up to but not including 15.5.21, and 16.0.0 up to but not including 16.2.11, contain a vulnerability where rewrites() or redirects() rules that construct external destination hostnames from user-controlled input can be exploited. This allows an attacker to specify arbitrary hostnames, leading to Server-Side Request Forgery (SSRF) in rewrites and Open Redirects in redirects. The issue arises when dynamic segments in the hostname are derived from request input without proper validation. Join the discussion | GCVE Database | 07/22/2026, 23:02:23 UTC Added: 07/23/2026, 01:18:05 UTC |
Showing 1 to 1 of 1 result