CVE-2026-44578

Next.js, a React framework for full-stack web applications, contains a server-side request forgery (CWE-918) flaw in the built-in Node.js server used by self-hosted deployments. An attacker can trigger it by sending crafted WebSocket upgrade requests, causing the server to proxy requests to arbitrary internal or external destinations chosen by the attacker. Successful abuse can expose internal services that are not meant to be reachable, including cloud metadata endpoints (e.g., instance credential stores), making this particularly risky in cloud environments. Only self-hosted applications running versions from 13.4.13 through before 15.5.16 and before 16.2.5 are affected; Vercel-hosted deployments are not affected. There is one public proof-of-concept exploit and a high EPSS score of 38.9% (98th percentile) indicating elevated near-term exploitation risk, but no confirmed widespread in-the-wild exploitation or KEV listing yet.

What to do: Self-hosted operators should upgrade Next.js to 15.5.16 or 16.2.5 as soon as possible; deployments on the 16.x line must move to 16.2.5. Until patched, restrict or review handling of WebSocket upgrade requests on the Node.js server and ensure cloud metadata endpoints (e.g., 169.254.169.254) are not reachable from application servers. Teams hosting on Vercel are not affected and need no action.