Next.js SSRF via Crafted WebSocket Requests (CVE-2026-44578)

A critical server-side request forgery (SSRF) vulnerability, CVE-2026-44578, has been identified in Next.js, a popular React framework. According to the National Vulnerability Database, versions 13.4.13 to before 15.5.16 and 16.2.5 are affected. This flaw impacts self-hosted Next.js applications utilizing the built-in Node.js server, allowing attackers to proxy requests to arbitrary internal or external destinations through specially crafted WebSocket upgrade requests.

This isn’t a theoretical risk; it’s a direct path to internal network reconnaissance and potential data exfiltration. An attacker can leverage this SSRF to scan internal services, access cloud metadata endpoints, or even interact with other internal APIs that are typically unexposed to the public internet. The CVSS score of 8.6 (High) reflects the significant impact, particularly the complete compromise of confidentiality (C:H) due to the ability to access sensitive internal resources. Importantly, the National Vulnerability Database confirms that Vercel-hosted deployments are not affected.

For defenders, this means any self-hosted Next.js application within the vulnerable version range is a prime target. The attacker’s calculus here is straightforward: exploit the SSRF to gain an internal foothold, then pivot to deeper network access. This is a classic initial access vector that can lead to much larger incidents. Patching is the immediate imperative, but understanding the full scope of potential internal exposure if exploited is also critical.