Next.js CVE-2026-44578
HIGH
GHSA-c4j6-fc7j-m34r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (https://github.com/vercel/next.js).
CVSS VectorVendor: https://github.com/vercel/next.js
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 21 npm packages depend on next (21 direct, 0 indirect)
Ecosystem-wide dependent count for version 13.4.13.
DescriptionCVE.org
Impact
Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected.
Fix
We now apply the same safety checks to WebSocket upgrade handling that already existed for normal HTTP requests, so upgrade requests are only proxied when routing has explicitly marked them as safe external rewrites.
Workarounds
If you cannot upgrade immediately, do not expose the origin server directly to untrusted networks. If WebSocket upgrades are not required, block them at your reverse proxy or load balancer, and restrict origin egress to internal networks and metadata services where possible.
AnalysisAI
Server-side request forgery in Next.js allows remote unauthenticated attackers to proxy requests to arbitrary internal or external destinations through crafted WebSocket upgrade requests in self-hosted applications using the built-in Node.js server. Attackers can access internal services and cloud metadata endpoints (AWS, GCP, Azure instance metadata) without authentication. This affects Next.js versions 13.4.13 through 15.5.15 and 16.0.0 through 16.2.4. Vendor-released patches available in versions 15.5.16 and 16.2.5. Vercel-hosted deployments are explicitly not affected.
Technical ContextAI
Next.js is a React-based web framework with server-side rendering capabilities. When self-hosted with the built-in Node.js server, Next.js handles WebSocket upgrade requests (HTTP/1.1 Upgrade header) to establish persistent bidirectional connections. The vulnerability stems from CWE-918 (Server-Side Request Forgery) in the WebSocket upgrade handling code. Unlike normal HTTP requests which underwent safety checks for routing and rewrite validation, WebSocket upgrade requests bypassed these controls, allowing attackers to manipulate the Upgrade handshake to force the server to initiate connections to attacker-specified destinations. This creates a proxy scenario where the Next.js server becomes an unwitting intermediary to internal resources (private network services, databases) or cloud metadata endpoints (169.254.169.254 on AWS/Azure, metadata.google.internal on GCP). The scope change (S:C) in CVSS indicates the vulnerability allows impacts beyond the vulnerable component's security scope, enabling cross-boundary attacks into otherwise isolated network segments.
RemediationAI
Upgrade Next.js to version 15.5.16 (for 15.x branch) or 16.2.5 (for 16.x branch) immediately. These versions apply the same routing safety checks to WebSocket upgrade handling that already existed for HTTP requests, ensuring upgrades are only proxied when explicitly marked as safe external rewrites. Release notes: https://github.com/vercel/next.js/releases/tag/v15.5.16 and https://github.com/vercel/next.js/releases/tag/v16.2.5. If immediate upgrade is not possible, implement these compensating controls with their associated trade-offs: (1) Do not expose the Next.js origin server directly to untrusted networks-place behind a hardened reverse proxy, though this adds infrastructure complexity and potential performance overhead. (2) Block WebSocket upgrade requests at your reverse proxy or load balancer level (check for 'Upgrade: websocket' header), but this breaks legitimate WebSocket functionality if your application requires it for real-time features. (3) Implement strict egress filtering on the Next.js server to allow outbound connections only to explicitly required external services, blocking access to RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254/32, metadata.google.internal), though overly restrictive rules may break legitimate internal service communication. Test egress rules thoroughly in staging before production deployment.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today