{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-29057/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vercel:next.js:*:*:*:*:*:*:*:*","cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-29057"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Next.js (\u003c 15.5.13, 16.1.7)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-29057","request-smuggling","web-vulnerability","vercel"],"_cs_type":"advisory","_cs_vendors":["Vercel"],"content_html":"\u003cp\u003eCVE-2026-29057 describes an HTTP request smuggling vulnerability in Vercel Next.js versions prior to 15.5.13 and 16.1.7. The issue arises from the desynchronization of shared HTTP connections when processing chunked \u003ccode\u003eTransfer-Encoding\u003c/code\u003e headers. An attacker can use a crafted request to cause the application's internal frontend/proxy component to misinterpret request boundaries, leading it to forward a smuggled request to an internal backend service.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a primary request to a public endpoint using \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe primary request body contains the serialized bytes of a secondary, unauthorized request (e.g., \u003ccode\u003eGET /secret\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe vulnerable frontend component fails to properly calculate or reconcile the length of the chunked message.\u003c/li\u003e\n\u003cli\u003eThe frontend component strips or modifies headers but leaves the smuggled payload in the buffered stream.\u003c/li\u003e\n\u003cli\u003eThe internal intermediary interprets the remaining bytes as a second, distinct HTTP request.\u003c/li\u003e\n\u003cli\u003eThe internal backend processes both the initial and the smuggled requests sequentially.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for unauthorized access to internal backend routes or administrative endpoints that are not intended to be exposed to public traffic.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Vercel Next.js to version 15.5.13, 16.1.7, or later immediately.\u003c/li\u003e\n\u003cli\u003eReview web access logs for anomalous \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e requests that contain embedded HTTP methods or internal path patterns.\u003c/li\u003e\n\u003cli\u003eApply strict request validation at the edge/WAF to normalize or reject malformed \u003ccode\u003eTransfer-Encoding\u003c/code\u003e headers before they reach the Next.js application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T04:07:07Z","date_published":"2026-10-31T04:07:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nextjs-smuggling/","summary":"CVE-2026-29057 is an HTTP request smuggling vulnerability in Next.js allowing attackers to smuggle secondary requests to internal backends via chunked transfer-encoding desynchronization.","title":"Vercel Next.js HTTP Request Smuggling (CVE-2026-29057)","url":"https://feed.craftedsignal.io/briefs/2026-10-nextjs-smuggling/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-29057","version":"https://jsonfeed.org/version/1.1"}