The version of Next.js installed on the remote host is 12.0.0 prior to 15.5.21 or 16.0.0 prior to 16.2.11. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in rewrites via an attacker-controlled destination hostname. (CVE-2026-64645)

- A Server-Side Request Forgery vulnerability in Server Actions on custom servers. This issue only affects versions 14.1.1 and later. (CVE-2026-64649)

- A Middleware / Proxy bypass in App Router applications using Turbopack and a single locale. This issue only affects versions 16.0.0 and later. (CVE-2026-64642)

- A denial of service vulnerability in App Router applications using Server Actions. This issue only affects versions 13.0.0 and later. (CVE-2026-64641)

- A denial of service vulnerability due to unbounded Server Action payloads in the Edge runtime. This issue only affects versions 13.0.0 and later. (CVE-2026-64646)

- A denial of service vulnerability in the Image Optimization API using SVGs. This issue only affects versions 15.5.0 and later. (CVE-2026-64644)

- A cache confusion of response bodies for requests with bodies. This issue only affects versions 13.0.0 and later. (CVE-2026-64648)

- A cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences. This issue only affects versions 13.0.0 and later. (CVE-2026-64647)

- An unauthenticated disclosure of internal Server Function endpoints. This issue only affects versions 13.0.0 and later. (CVE-2026-64643)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20
    and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname
    from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname
    suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the
    application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is
    vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.
    (CVE-2026-64645)

远程主机上的 Next.js Framework 受到服务器端请求伪造漏洞的影响：

  - 根据请求控制的输入构建其外部目标主机名的 rewrites（） 或 redirects（） 规则可指向任意主机名，而不管该规则的主机名后缀为何。对于重写，Next.js 将请求委托给该任意主机并提供来自应用程序源的响应，从而导致服务器端请求伪造。以此方式配置的 redirects（） 规则容易受到开放重定向攻击。（CVE-2026-64645）

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端主機上的 Next.js Framework 受到伺服器端要求偽造弱點影響：

  - 不論規則的主機名稱尾碼為何，從要求控制的輸入建立外部目的地主機名稱的 rewrites（） 或 redirects（） 規則都可以指向任意主機名稱。對於重寫，Next.js將請求代理到該任意主機，並提供來自應用程式來源的回應，從而導致伺服器端要求偽造。以這種方式設定的 redirects（） 規則容易受到開放重新導向的影響。（CVE-2026-64645）

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートホスト上の Next.js Framework は、サーバーサイドリクエスト偽造脆弱性の影響を受けます。

  - リクエストコントロール入力から外部宛先ホスト名を構築する rewrites() または redirects() ルールは、ルールのホスト名サフィックスに関係なく、任意のホスト名を指定できます。書き換えの場合、Next.jsはその任意のホストにリクエストをプロキシし、アプリケーションのオリジンからの応答を提供するため、サーバー側のリクエスト偽造を引き起こします。このように構成されたredirects()ルールは、オープンリダイレクトに対して脆弱です。(CVE-2026-64645)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The Next.js Framework on the remote host is affected by a server-side request forgery vulnerability:

  - A rewrites() or redirects() rule that builds its external destination hostname from request-controlled     input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite,     Next.js proxies the request to that arbitrary host and serves the response from the application's origin,     leading to Server-Side Request Forgery. A redirects() rule configured this way is vulnerable to an Open     Redirect. (CVE-2026-64645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
115757	Next.js 16.0.x < 16.2.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115756	Next.js 12.0.0 < 15.5.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
445136	SCA: security update for next (GHSA-p9j2-gv94-2wf4)	Tenable Self-Hosted Container Security	SCA Checks	2026/7/23	2026/8/10	high
460602	Echo: next: security update to 15.5.21	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/2	2026/10/5	high
445136	SCA: security update for next (GHSA-p9j2-gv94-2wf4)	Tenable Cloud Security	SCA Checks	2026/7/23	2026/8/10	high
460602	Echo: next: security update to 15.5.21	Tenable Cloud Security	Echo Local Security Checks	2026/10/2	2026/10/5	high
330090	Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF	Nessus	Misc.	2026/7/27	2026/7/30	high
330090	Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF	Nessus	Misc.	2026/7/27	2026/7/30	high
330090	Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF	Nessus	Misc.	2026/7/27	2026/7/30	high
330090	Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF	Nessus	Misc.	2026/7/27	2026/7/30	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high