CVE

CVE-2026-44578

8.6

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

next.jsstreams for apache kafka 2.9.4red hat trusted artifact signer 1.3red hat trusted artifact signer 1.4red hat enterprise linux 10red hat enterprise linux 7

Updated Nov 10, 2026View on NVD →

S4E scanner

highNetwork Vulnerabilities~10 seconds

Next.js WebSocket Upgrade Handler - SSRF

Next.js 13.4.13 to before 15.5.16 and 16.2.5 contains a server-side request forgery caused by crafted WebSocket upgrade requests in the built-in Node.js server, letting attackers proxy requests to arbitrary destinations, exploit requires self-hosted deployment. References: https://github.com/advisories/GHSA-c4j6-fc7j-m34r https://nextjs.org/blog/next-15-5-16 https://app.hacktron.ai/disclosed/scans/web_dmVyY2VsL25leHQtanMtbWlycm9y_1774994038380_2hfQkCKG/findings/66f26e9e-a71f-4997-85be-a0b5fa3b7d89 Remediation: Upgrade to versions 15.5.16 or 16.2.5 or later.

9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: next.js

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →