CVE Wiki Pixee · CVE intelligence
← All CVEs

CVE-2026-44578

High · CVSS 8.6

Next.js — Server-Side Request Forgery (SSRF) via WebSocket upgrade request proxying

CVSS
8.6
nvd
EPSS
38.9%
98th pct
KEV
No
Class
oss containerizable
CWE-918, CWE-918

Description

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

Search profile — drives PoC discovery

Symbols WebSocketupgradeproxyNode.js serverWebSocket upgrade requestinternal servicescloud metadataGHSA-c4j6-fc7j-m34r
Keywords CVE-2026-44578Next.js SSRFNext.js WebSocket SSRFNext.js upgrade request proxyGHSA-c4j6-fc7j-m34rNext.js self-hosted SSRFNext.js Node.js server SSRFNext.js WebSocket upgrade exploitNext.js internal service exposureNext.js cloud metadata SSRFCWE-918 Next.js
Versions: >=13.4.13, <15.5.16 and <16.2.5

Ranked PoCs (8) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

Affected packages

npm next 13.4.13 → 15.5.16
npm next 16.0.0 → 16.2.5

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T12:30:14.000Z