CVE-2026-44578

What it is

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure.

Exploit odds

35.5% chance of exploitation in the next 30 days (EPSS). Higher than most.

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-05-13 18:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-26 14:10 UTC Last updatedMost recent change to the record

Details

Published

2026-05-13 18:16 UTC

Last modified

2026-10-26 14:10 UTC

Exploit probability

35.5% · EPSS, next 30 days

Weakness

CWE-918 · Server-side request forgery

Record status

Modified

Affected

• Vercel next.js < 15.5.16
• Vercel next.js < 16.2.5

Attack profile CVSS 3.1 · 8.6

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None