CVE-2026-44578 Details
Description
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
A server-side request forgery (SSRF) vulnerability has been identified in Next.js, a React framework for full-stack web applications. This issue affects self-hosted applications using the built-in Node.js server, specifically versions 13.4.13 prior to 15.5.16 and 16.0.0 prior to 16.2.5. The vulnerability arises from crafted WebSocket upgrade requests that can manipulate the server into proxying requests to arbitrary internal or external destinations. This could potentially expose internal services or cloud metadata endpoints. Notably, deployments hosted on Vercel are not affected.
Users can upgrade to Next.js versions 15.5.16 or 16.2.5, where this vulnerability has been patched. If an immediate upgrade is not possible, it is recommended to avoid exposing the origin server to untrusted networks. For applications that do not require WebSocket upgrades, these can be blocked at the reverse proxy or load balancer. Additionally, restrict outgoing connections to internal networks and metadata services when possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:34608 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:37272 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:40974 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:54435 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-44578 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477187 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44578.json | redhat-SADP | |
| https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | redhat-SADP |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 13.4.13, < 15.5.16 >= 16.0.0, < 16.2.5 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Jul 16, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |