8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44578

CVE-2026-44578: Next.js: Server-side request forgery in applications using WebSocket upgrades

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44578

CVE-2026-44578:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 13.4.13, < 15.5.16	15.5.16
next	npm	>= 16.0.0, < 16.2.5	16.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how Next.js handles WebSocket upgrade requests in self-hosted environments. An attacker could craft a special WebSocket upgrade request containing an absolute URL. The initialize function in packages/next/src/server/lib/router-server.ts was responsible for handling these upgrade requests. The analysis of the patch commit 5b194ee2d452744eb839856a670bdc33b03062c4 reveals that the upgrade event listener within the initialize function was vulnerable. Previously, the code only checked if the parsed URL from the request had a protocol. If it did, it would unconditionally proxy the request using proxyRequest. This allowed an attacker to force the server to make a request to an arbitrary internal or external service. The patch introduces additional checks on the result of resolveRoutes, specifically the finished and statusCode properties, to ensure that a request is only proxied if it corresponds to a legitimate and safe rewrite, thus mitigating the SSRF vulnerability.

Vulnerable functions

initialize

packages/next/src/server/lib/router-server.ts

The `initialize` function sets up an 'upgrade' event handler for the HTTP server. Before the patch, this handler would call `proxyRequest` if the request URL had a protocol. This allowed an attacker to specify an arbitrary absolute URL for a WebSocket upgrade request, leading to Server-Side Request Forgery (SSRF). The `proxyRequest` function would then forward this request to the specified internal or external destination. The patch adds checks from the `resolveRoutes` function's result to ensure that the request is a valid and safe rewrite before proxying.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.