Next

CVE-2026-44578 is a server-side request forgery bug in Next.js WebSocket upgrade handling. Affected versions are >=13.4.13 <15.5.16 and >=16.0.0 <16.2.5, and the exposure is specifically self-hosted deployments using the built-in Node.js server. The vulnerable path lets a crafted WebSocket upgrade request trick the origin into proxying to attacker-chosen internal or external destinations, including localhost services or cloud metadata endpoints.

The vendor's HIGH 8.6 is directionally fair, but a little hot for enterprise prioritization because the reachable population is narrower than the CVSS suggests. This is not a generic Next.js internet bug, not a Vercel-hosted issue, and not direct code execution; it is a deployment-contingent SSRF whose real damage depends on what the origin can reach over the network.

Why this verdict

• Unauthenticated remote path: no auth, no user click, and no complicated exploit chain to trigger the SSRF primitive
• Deployment friction lowers the score: only self-hosted Next.js using the built-in Node.js server is affected; Vercel-hosted deployments are out, which materially shrinks the exposed population
• Blast radius is conditional: the bad outcome depends on what the app tier can reach, whether metadata is hardened, and whether egress controls block internal destinations

Why not higher?

This is not direct RCE and not a universal Next.js flaw. An attacker still needs a reachable vulnerable origin and something valuable behind it such as permissive metadata, localhost admin ports, or weakly trusted internal APIs; those prerequisites are where many enterprise deployments add real friction.

Why not lower?

Do not over-downgrade it just because it is 'only SSRF.' Unauthenticated SSRF from an internet-facing app tier is exactly how attackers steal cloud credentials, hit localhost-only admin surfaces, and pivot into internal services without ever touching user auth.

1. Block upgrade traffic where unused — If the application does not need WebSocket upgrades, deny Connection: Upgrade / Upgrade: websocket at the reverse proxy or load balancer. For a HIGH verdict, deploy this within 30 days; if the origin is internet-exposed and you cannot patch immediately, do it sooner.
2. Deny metadata and private-range egress — Block app-tier access to 169.254.169.254, localhost admin ports, and unnecessary RFC1918 destinations from the Next.js host or pod. This directly cuts the value of the SSRF even if the bug is still present; for a HIGH verdict, put these egress controls in place within 30 days.
3. Hide origins behind trusted ingress — Do not expose the built-in Next.js origin directly to untrusted networks; place it behind a hardened ingress or reverse proxy that only forwards the traffic patterns you actually use. For this HIGH finding, prioritize this architectural containment within 30 days if patching has operational delay.
4. Monitor outbound from Node.js — Alert on the Node.js process initiating connections to metadata IPs, RFC1918 space, localhost service ports, or unusual external destinations immediately after upgrade requests. Detection will not stop the bug, but it shortens dwell time while you work through the 30-day mitigation window.

Run this on the application host, container, CI workspace, or source repo checkout that contains the Next.js app. Invoke it with python3 verify_next_cve_2026_44578.py /path/to/app and no elevated privileges are required; it reads package.json, lockfiles, and node_modules/next/package.json if present.

#!/usr/bin/env python3
# verify_next_cve_2026_44578.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import json
import os
import re
import sys
from typing import Optional, Tuple


def parse_semver(v: str) -> Optional[Tuple[int, int, int]]:
    if not v:
        return None
    v = v.strip()
    if v.startswith('v'):
        v = v[1:]
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def is_vulnerable(ver: Tuple[int, int, int]) -> bool:
    return (cmp_ver(ver, (13, 4, 13)) >= 0 and cmp_ver(ver, (15, 5, 16)) < 0) or \
           (cmp_ver(ver, (16, 0, 0)) >= 0 and cmp_ver(ver, (16, 2, 5)) < 0)


def load_json(path: str):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            return json.load(f)
    except Exception:
        return None


def get_version_from_package_json(app_dir: str) -> Optional[str]:
    data = load_json(os.path.join(app_dir, 'package.json'))
    if not data:
        return None
    for section in ('dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'):
        deps = data.get(section, {})
        if isinstance(deps, dict) and 'next' in deps:
            return str(deps['next'])
    return None


def get_installed_version(app_dir: str) -> Optional[str]:
    nm = os.path.join(app_dir, 'node_modules', 'next', 'package.json')
    data = load_json(nm)
    if data and isinstance(data.get('version'), str):
        return data['version']
    return None


def clean_spec(spec: str) -> Optional[str]:
    if not spec:
        return None
    spec = spec.strip()
    m = re.search(r'(\d+\.\d+\.\d+)', spec)
    return m.group(1) if m else None


def main() -> int:
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_next_cve_2026_44578.py /path/to/app')
        return 2

    app_dir = sys.argv[1]
    if not os.path.isdir(app_dir):
        print(f'UNKNOWN - path not found: {app_dir}')
        return 2

    installed = get_installed_version(app_dir)
    declared = get_version_from_package_json(app_dir)

    version_source = None
    version_str = None

    if installed:
        version_source = 'installed node_modules/next/package.json'
        version_str = installed
    elif declared:
        cleaned = clean_spec(declared)
        if cleaned:
            version_source = 'declared package.json dependency spec'
            version_str = cleaned

    if not version_str:
        print('UNKNOWN - could not determine Next.js version from node_modules or package.json')
        return 2

    ver = parse_semver(version_str)
    if not ver:
        print(f'UNKNOWN - could not parse Next.js version: {version_str}')
        return 2

    if is_vulnerable(ver):
        print(f'VULNERABLE - detected Next.js {version_str} from {version_source}; CVE-2026-44578 affects >=13.4.13 <15.5.16 and >=16.0.0 <16.2.5 in self-hosted apps using the built-in Node.js server')
        return 1

    print(f'PATCHED - detected Next.js {version_str} from {version_source}; version is outside the vulnerable ranges for CVE-2026-44578')
    return 0


if __name__ == '__main__':
    sys.exit(main())

Sources

1. GitHub Security Advisory GHSA-c4j6-fc7j-m34r
2. Patch commit c4f6908
3. Vercel changelog: Next.js May 2026 security release
4. NVD entry
5. Horizon3 analysis
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation
8. ProjectDiscovery nuclei-templates release notes