Description

A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) or Open Redirect attacks. When a rewrites() or redirects() rule constructs an external destination hostname using attacker-controlled input, the application can be coerced into proxying requests to arbitrary hosts, leading to SSRF. Additionally, this misconfiguration can result in Open Redirects, potentially exposing users to phishing.

Mitigation

Aliases

References