CVE-2026-44578
HighCVSS 8.6Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Next.js versions from 13.4.13 to before 15.5.16 and 16.2.5 are vulnerable to server-side request forgery (SSRF) via crafted WebSocket upgrade requests. An attacker can force the server to proxy requests to arbitrary internal or external destinations, potentially exposing internal services or cloud metadata endpoints.
Risk Assessment
The risk involves unauthorized access to internal network resources such as backend services, databases, or cloud metadata, which could lead to data leakage or further infrastructure compromise.
Recommendation
Immediately upgrade Next.js to version 15.5.16 or 16.2.5, which contain the fix. If upgrading is not possible, restrict access to the Node.js server to trusted sources only.
Original NVD description (English source)
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.