Next.js, one of the world's most widely used React frameworks, is putting thousands of organizations at risk of credential theft, API key exposure, and unauthorized access to internal admin panels. The vulnerability, disclosed this week, requires no credentials and no user interaction to exploit. That combination makes it particularly dangerous for any team running Next.js in production on their own infrastructure.
On May 11, 2026, Vercel published GHSA-c4j6-fc7j-m34r and released Next.js 15.5.16 and 16.2.5, fixing CVE-2026-44578, a server-side request forgery vulnerability in the WebSocket upgrade handler that affects all self-hosted Next.js deployments from 13.4.13 onward. If you haven't patched yet, stop reading and go do that first.
Sampling of directly-exposed Shodan-indexed Next.js hosts on the default port suggests approximately 79,000 instances are exploitable today. That's not a small tail risk.
What Is CVE-2026-44578?
CVE-2026-44578 details a Server-Side Request Forgery (SSRF) vulnerability affecting self-hosted Next.js applications using the built-in Node.js server, rated 8.6 (High) on the CVSS scale. SSRF, for those less familiar, is an attack class where a server is tricked into making outbound HTTP requests on behalf of an attacker, typically to internal resources that should never be reachable from the public internet.
In CVE-2026-44578, the vulnerability exists in Next.js's HTTP/1.1 WebSocket upgrade handler in packages/next/src/server/lib/router-server.ts. When a client sends an HTTP Upgrade request with Connection: Upgrade and Upgrade: websocket headers, the upgrade handler calls resolveRoutes to determine the request's destination.
The vulnerable handler then checks only parsedUrl.protocol before forwarding to proxyRequest, ignoring the finished and statusCode flags that the equivalent HTTP request handler already enforces. That missing check is the entire root cause. One incomplete conditional, and the server becomes a proxy for any destination the attacker names.
How the Attack Works
The flaw lets an unauthenticated attacker, with a single crafted HTTP request, cause the Next.js process to issue an internal HTTP GET to any host reachable from the server on port 80, including cloud metadata services, administrative panels, and internal APIs, and read the response.
The cloud metadata angle is the most severe. The impact is particularly severe in cloud-hosted environments because cloud metadata services on port 80 are reachable from inside the instance, including AWS IMDSv1 (169.254.169.254), Azure IMDS, Oracle OCI, and DigitalOcean metadata.
