High severity · published May 13, 2026
CVE-2026-44578
Next.js: Server-side request forgery in applications using WebSocket upgrades
8.6
CVSS
35.5%
EPSS
No
On KEV
Description
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)35.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
next.js · vercel
>= 16.0.0, < 16.2.5; >= 13.4.13, < 15.5.16 · source: vendor, NVD
RH
Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Trusted Artifact Signer 1.3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Trusted Artifact Signer 1.4 · Red Hat
All versions, or not specified · source: CISA
SF
streams for Apache Kafka 3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44578
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44578
Mitigation
https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:34608
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:37272
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:40974
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:54435
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-44578
More from next.js
10.0
CVE-2025-55182
Meta React Server Components Remote Code Execution Vulnerability
9.1
CVE-2025-29927
Next.js is a React framework for building full-stack web applications
9.0
CVE-2026-75604
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
8.2
CVE-2026-94482
Next.js: Denial of Service in App Router using Server Actions
8.2
CVE-2026-64642
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale