Log in Start free

Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgrades

High 8.6

In plain English

A high-severity server-side request forgery in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 35.5% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)35.5%top 1.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmnext15.5.16GHSA-c4j6-fc7j-m34r
npmnext16.2.5GHSA-c4j6-fc7j-m34r

Affected products (as reported)

VendorProductVersions
vercel next.js >= 16.0.0, < 16.2.5>= 13.4.13, < 15.5.16

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References