CVE-2026-44578High· 8.6▾ MidnightPoC availableNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 7.8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
39%
39% → 39%
8 GitHub repos · Nuclei ×1
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
next.js >= 13.4.13, < 15.5.16next.js >= 16.0.0, < 16.2.5Upgrade past the affected range:
next.js 16.2.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44579High· 7.5Next.js is a React framework for building full-stack web applications
CVE-2026-45109High· 7.5Next.js is a React framework for building full-stack web applications
CVE-2026-44577Medium· 5.9Next.js is a React framework for building full-stack web applications
CVE-2026-44575High· 7.5Next.js is a React framework for building full-stack web applications
CVE-2026-44574High· 8.1Next.js is a React framework for building full-stack web applications
CVE-2026-44573High· 7.5Next.js is a React framework for building full-stack web applications