A critical Server-Side Request Forgery and Open Redirect vulnerability in Next.js allows unauthenticated attackers to manipulate application requests, posing a significant risk to internal network security.

The software contains flaws related to CWE-918 (Server-Side Request Forgery) and CWE-601 (Open Redirect). These vulnerabilities allow unauthenticated remote attackers to force the server to make unintended requests or redirect users to malicious destinations.

Successful exploitation of these vulnerabilities could lead to the unauthorized disclosure of internal service data or facilitate phishing campaigns via open redirects. Given the CVSS score of 8.3, this is a high-severity issue that could compromise the integrity of the application environment and damage user trust in the platform.

Immediate Action: Update your Next.js installation to version 15.5.21 or 16.2.11 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review web access logs for unusual outbound requests or suspicious redirect patterns that deviate from established application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious input and restrict outbound traffic from the application server to sensitive internal endpoints.

Public Exploit Available: No

The high CVSS score reflects the serious potential for unauthorized network interaction. Administrators should prioritize patching these versions to eliminate the underlying request handling defects and prevent potential exploitation.