CVE Watch27 jul 2026

CVE-2026-64645

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rew

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 27 jul 2026 · Última mod.: 27 jul 2026 · CWE-601 · CWE-918

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-654427.2 ALT

—

———Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.8h CVE-2026-619537.2 ALT

—

———Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.8h CVE-2026-53669—

—

———React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.9h CVE-2026-536686.9 MED

—

———React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.9h CVE-2026-59730—

—

———Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host. Preconditions for exploitation: trailingSlash: 'always' must be set (non-default; the default is 'ignore'), the request path must not have a file extension in its final segment, and an attacker must deliver the crafted link to a user. This issue has been fixed in version 11.0.2.10h CVE-2026-659256.5 MED

—

———A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.10h