CVE-2026-44578

HighCVSS 8.6/10Last modified Aug 13, 2026

Description

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2026
Last modified: Aug 13, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-445797.5Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Preren CVE-2026-44588.8Use after free in Extensions in Google Chrome prior to 146.0.7680.153 allowed an attacker who convinced a user to install a malicious extens CVE-2026-445806.1Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use befor CVE-2026-445814.7Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications tha CVE-2026-445823.7Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component resp CVE-2026-445835.3Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endp CVE-2026-445844.3Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functi CVE-2026-445855.4Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation end CVE-2026-445868.3SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package auth CVE-2026-445876.1CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fai CVE-2026-445889.4SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts rea CVE-2026-445893.7Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHS