Product
CVE-2026-29057 is an HTTP request smuggling vulnerability in Next.js allowing attackers to smuggle secondary requests to internal backends via chunked transfer-encoding desynchronization.