CVE-2026-44578

Published May 13, 2026

Last updated 24 days ago

Next.js

Port (80)

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-44578 is a Server-Side Request Forgery (SSRF) vulnerability that impacts self-hosted Next.js applications utilizing the built-in Node.js server. This flaw is triggered by specially crafted WebSocket upgrade requests. An attacker can exploit this vulnerability to manipulate the affected server into proxying requests to arbitrary internal or external destinations. This could potentially expose internal network resources or cloud metadata endpoints. Vercel-hosted deployments are not affected by this specific vulnerability, and the resolution involves implementing the same safety checks for WebSocket upgrade handling that are already present for standard HTTP requests.

Description: Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
Source: security-advisories@github.com
NVD status: Analyzed
Products: next.js

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.6
Impact score: 4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-918

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "9845CDE5-B999-458E-9FCE-E1D0F63B8AC6",
            "versionEndExcluding": "15.5.16",
            "versionStartIncluding": "13.4.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A",
            "versionEndExcluding": "16.2.5",
            "versionStartIncluding": "16.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.