CVE-2026-64645 in Next.js 16.1.1

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Severity

High 8.3

Exploitation

0% chance of exploit
in the next 30 days

Fix

Update to 16.2.11

Where

App / API

How it matched

Exact version match

Also known as

GHSA-p9j2-gv94-2wf4

First seen

2026-11-05 01:13:58 UTC

Source

https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4