CVE-2026-44578

Next.js: Server-side request forgery in applications using WebSocket upgrades

At a glance

Severity: HIGH 8.6
EPSS: EPSS 35.54 % · percentile 98 (2026-10-28)
State: PUBLISHED
Published: 2026-05-13
Updated: 2026-08-13
Assigner: GitHub_M
NVD status: Modified

Description

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	GitHub_M
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	redhat-SADP
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Weaknesses (CWE)

CWE-918

Advisories

GHSA-c4j6-fc7j-m34r — Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

European references

ENISA EUVD · EUVD-2026-30080
GCVE · GCVE-0-2026-44578

CERT-FR advisories

CERTFR-2026-AVI-1256 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0901 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 13.4.13 < 15.5.16
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 16.0.0 < 16.2.5

Affected products

Product	Versions
vercel · next.js	affected >= 16.0.0, < 16.2.5 ; affected >= 13.4.13, < 15.5.16

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD