6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29057

CVE-2026-29057: Next.js: HTTP request smuggling in rewrites

Summary

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

Impact

An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.

Patches

The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.

Workarounds

If upgrade is not immediately possible:

Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
Enforce authentication/authorization on backend routes per our security guidance.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29057

CVE-2026-29057:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 16.0.0-beta.0, < 16.1.7	16.1.7
next	npm	>= 9.5.0, < 15.5.13	15.5.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a form of HTTP request smuggling that occurs in Next.js's proxy layer when handling rewrites. The root cause lies within the vendored http-proxy library, specifically in the deleteLength function located in lib/http-proxy/passes/web-incoming.js.

When a DELETE or OPTIONS request containing a Transfer-Encoding: chunked header but no Content-Length header is sent to a rewritten route, the deleteLength function would incorrectly modify the request. It would add a Content-Length: 0 header and then delete the Transfer-Encoding header. This inconsistent handling created a desynchronization between the Next.js proxy and the backend server. The proxy would process a request with Content-Length: 0, but the backend could still see a chunked request, allowing an attacker to smuggle a second, malicious request in the body of the first one.

The patch addresses this in two ways:

It modifies deleteLength to only add Content-Length: 0 if both Content-Length and Transfer-Encoding headers are absent. It also stops deleting the Transfer-Encoding header. This is the primary fix.
It modifies the setupOutgoing function in lib/http-proxy/common.js to proactively set the Connection header to close for any request that uses Transfer-Encoding. This is a secondary mitigation to prevent connection reuse, which is necessary for this type of request smuggling attack.

Therefore, the primary vulnerable function that would appear in a runtime profile during exploitation is deleteLength. The setupOutgoing function is also relevant as it was modified to harden the proxy against this attack vector.

Vulnerable functions

deleteLength

lib/http-proxy/passes/web-incoming.js

This function processes incoming requests before they are proxied. The vulnerability lies in how it handles DELETE/OPTIONS requests. When such a request was received without a 'content-length' header, the function would set 'content-length: 0' and, crucially, delete the 'transfer-encoding' header. This allowed an attacker to craft a request with 'transfer-encoding: chunked' that would be interpreted differently by the Next.js proxy and the backend server, leading to HTTP request smuggling.

setupOutgoing

lib/http-proxy/common.js

This function prepares the outgoing proxied request. While not the source of the vulnerability, it was modified as part of the patch to add a defense-in-depth mitigation. The change forces the proxy to close the connection to the backend (`Connection: close`) if the request uses `Transfer-Encoding`. This prevents a smuggled request from being processed on a persistent connection, containing the impact of the original vulnerability in `deleteLength`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.