Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect.

This affects any destination that puts a dynamic segment in the hostname, whether from the path:

 1// next.config.js
 2module.exports = {
 3  async rewrites() {
 4    return [
 5      {
 6        source: '/:tenant',
 7        destination: 'https://:tenant.api.example.com',
 8      },
 9    ]
10  },
11}

or from a has capture:

 1// next.config.js
 2module.exports = {
 3  async rewrites() {
 4    return [
 5      {
 6        source: '/',
 7        has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
 8        destination: 'https://:region.api.example.com',
 9      },
10    ]
11  },
12}

If you cannot upgrade immediately, do not build the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: value: '(?<region>[a-z0-9-]+)'.