{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/next.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["next.js"],"_cs_severities":["high"],"_cs_tags":["ssrf","cve-2026-44578","next.js","websocket","server-side request forgery"],"_cs_type":"advisory","_cs_vendors":["Vercel"],"content_html":"\u003cp\u003eNext.js applications utilizing WebSocket upgrades are susceptible to a server-side request forgery (SSRF) vulnerability. This flaw allows an attacker to craft WebSocket upgrade requests, forcing the server to proxy requests to arbitrary internal or external destinations. This vulnerability is present in self-hosted Next.js applications using the built-in Node.js server. Vercel-hosted deployments are not affected. The vulnerability is present in versions npm/next (\u0026gt;= 13.4.13, \u0026lt; 15.5.16) and npm/next (\u0026gt;= 16.0.0, \u0026lt; 16.2.5). The fix involves applying the same safety checks to WebSocket upgrade handling that already existed for normal HTTP requests, ensuring upgrade requests are only proxied when routing has explicitly marked them as safe external rewrites. This issue is tracked as CVE-2026-44578.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a self-hosted Next.js application utilizing WebSocket upgrades.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious WebSocket upgrade request. This request contains a target destination (internal or external) to which the server will be forced to proxy the request.\u003c/li\u003e\n\u003cli\u003eThe attacker sends the crafted WebSocket upgrade request to the Next.js server.\u003c/li\u003e\n\u003cli\u003eThe Next.js server, lacking proper validation, processes the malicious upgrade request.\u003c/li\u003e\n\u003cli\u003eThe server initiates a connection to the attacker-specified destination.\u003c/li\u003e\n\u003cli\u003eThe server proxies data between the attacker and the target destination.\u003c/li\u003e\n\u003cli\u003eThe attacker gains access to internal services, cloud metadata endpoints, or other sensitive resources.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates sensitive information or leverages the access for further malicious activities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this SSRF vulnerability (CVE-2026-44578) can lead to the exposure of internal services, cloud metadata endpoints, or other sensitive resources. Attackers can potentially gain unauthorized access to sensitive data or internal systems, leading to data breaches, privilege escalation, or further compromise of the affected infrastructure. The number of victims and the specific sectors targeted depend on the deployment and configurations of the vulnerable Next.js applications. Vercel-hosted deployments are not affected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Next.js to a patched version (\u0026gt;= 15.5.16 or \u0026gt;= 16.2.5) to remediate the vulnerability as described in GHSA-c4j6-fc7j-m34r.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Suspicious WebSocket Upgrade Requests\u003c/code\u003e to detect potential exploitation attempts by monitoring for suspicious target domains in WebSocket upgrade requests.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, implement the suggested workarounds: do not expose the origin server directly to untrusted networks and block WebSocket upgrades at the reverse proxy or load balancer if they are not required, as described in GHSA-c4j6-fc7j-m34r.\u003c/li\u003e\n\u003cli\u003eRestrict origin egress to internal networks and metadata services where possible, as recommended in GHSA-c4j6-fc7j-m34r.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-11T15:56:10Z","date_published":"2026-05-11T15:56:10Z","id":"https://feed.craftedsignal.io/briefs/2026-05-nextjs-ssrf/","summary":"Next.js applications using WebSocket upgrades are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to internal or external destinations, affecting self-hosted applications running versions npm/next (\u003e= 13.4.13, \u003c 15.5.16) and npm/next (\u003e= 16.0.0, \u003c 16.2.5).","title":"Next.js SSRF Vulnerability via WebSocket Upgrade Requests (CVE-2026-44578)","url":"https://feed.craftedsignal.io/briefs/2026-05-nextjs-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed — Next.js","version":"https://jsonfeed.org/version/1.1"}