AIKIDO-2026-573829
next is vulnerable to Server-Side Request Forgery (SSRF)
83
High Risk
This Affects:
nextTL;DR
Next.js resolves the destination of a rewrites() or redirects() rule using values taken from the incoming request, such as a path segment or a has capture. When a rule builds the destination hostname from that untrusted input, the request can be pointed at an arbitrary host regardless of the configured hostname suffix. A rewrites() rule then makes next proxy the request to that host and return its response from the application origin, causing Server-Side Request Forgery, while a redirects() rule becomes an open redirect. The fix constrains dynamic destination hostnames so they can no longer resolve to unintended hosts.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your rewrites() or redirects() configuration builds an external destination hostname from untrusted input.
Background info
next is vulnerable to Server-Side Request Forgery (SSRF) in versions 12.0.0 - 15.5.20 and 16.0.0 - 16.2.10.
How to fix this
Upgrade the next library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant