Next.js allows users to define rewrite and redirect rules that build the external destination hostname from request‑controlled input. When a rewrite rule points to an arbitrary hostname, Next.js proxies the request to that host and streams the response back to the application’s origin, creating a Server‑Side Request Forgery (SSRF) condition. A redirect rule configured in the same way becomes an Open Redirect. This flaw is governed by CWE‑601 and CWE‑918 and, if exploited, can enable external actors to probe internal network services or exfiltrate data through the application’s server.

The affected product is Vercel’s Next.js framework. Versions from 12.0.0 to 15.5.20 inclusive and from 16.0.0 to 16.2.10 inclusive are vulnerable. The security fixes are included in releases 15.5.21 and 16.2.11.

The CVSS score of 8.3 indicates high severity with full exploitation potential. EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited, but possible, attack prevalence. The likely attack vector involves an unauthenticated remote attacker crafting a request that triggers a rewrite or redirect rule with a malicious destination hostname, thereby executing the SSRF or being redirected to an external site.