CVE-2026-44578highCWE-918

CVE-2026-44578: high-severity vulnerability in vercel next.js

Next.js: Server-side request forgery in applications using WebSocket upgrades

Published · Updated

Follow this CVE+ Monitor next.js+ Monitor next

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.6epss 36%
from disclosure to weaponsame day
Published on NVDMay 13
1st PoCMay 13
In short

Next.js applications using WebSocket upgrades can be tricked into making requests to internal or external servers that they shouldn't access, potentially exposing sensitive internal services or cloud metadata. This only affects self-hosted deployments, not those on Vercel.

Technical detail

Server-side request forgery (SSRF) vulnerability in Next.js versions 13.4.13 through 15.5.15 and 16.0.0 through 16.2.4 when using the built-in Node.js server. Attackers can craft malicious WebSocket upgrade requests to force the server to proxy HTTP/HTTPS requests to arbitrary destinations, bypassing network access controls and potentially retrieving sensitive metadata or internal service responses.

Summary generated and translated by AI from the official description.
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
vercel · next.js
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — vercel next.js

In the same product, most dangerous first.

CVE-2025-29927CRITICALAuthorization Bypass in Next.js MiddlewareEPSS 99.2%CVE-2024-46982HIGHCache Poisoning in next.jsEPSS 59.2%CVE-2021-43803HIGHUnexpected server crash in Next.jsEPSS 47.3%CVE-2024-34351HIGHNext.js Server-Side Request Forgery in Server ActionsEPSS 5.5%CVE-2024-51479HIGHAuthorization bypass in Next.jsEPSS 4.0%CVE-2025-57822MEDIUMNext.js Improper Middleware Redirect Handling Leads to SSRFEPSS 2.6%