Vercel Next.js HTTP Request Smuggling (CVE-2026-29057)

CVE-2026-29057 describes an HTTP request smuggling vulnerability in Vercel Next.js versions prior to 15.5.13 and 16.1.7. The issue arises from the desynchronization of shared HTTP connections when processing chunked Transfer-Encoding headers. An attacker can use a crafted request to cause the application's internal frontend/proxy component to misinterpret request boundaries, leading it to forward a smuggled request to an internal backend service.

Attack Chain

1. Attacker sends a primary request to a public endpoint using Transfer-Encoding: chunked.
2. The primary request body contains the serialized bytes of a secondary, unauthorized request (e.g., GET /secret).
3. The vulnerable frontend component fails to properly calculate or reconcile the length of the chunked message.
4. The frontend component strips or modifies headers but leaves the smuggled payload in the buffered stream.
5. The internal intermediary interprets the remaining bytes as a second, distinct HTTP request.
6. The internal backend processes both the initial and the smuggled requests sequentially.

Impact

The vulnerability allows for unauthorized access to internal backend routes or administrative endpoints that are not intended to be exposed to public traffic.

Recommendation

• Upgrade Vercel Next.js to version 15.5.13, 16.1.7, or later immediately.
• Review web access logs for anomalous Transfer-Encoding: chunked requests that contain embedded HTTP methods or internal path patterns.
• Apply strict request validation at the edge/WAF to normalize or reject malformed Transfer-Encoding headers before they reach the Next.js application.