https://feed.craftedsignal.io/tags/next.js/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 11 May 2026 15:59:02 +0000https://feed.craftedsignal.io/briefs/2026-05-nextjs-dos/Mon, 11 May 2026 15:59:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-nextjs-dos/Next.js applications using Partial Prerendering through Cache Components are vulnerable to connection exhaustion (CVE-2026-44579), where crafted POST requests to a server action trigger a request-body handling deadlock, consuming server capacity and leading to denial of service.A denial-of-service vulnerability (CVE-2026-44579) exists in Next.js applications that utilize Partial Prerendering through the Cache Components feature. This flaw allows an attacker to exhaust server connections by sending specially crafted POST requests to a server action. The malicious requests trigger a deadlock in request-body handling, causing connections to remain open for an extended period. This leads to the consumption of file descriptors and server capacity, ultimately denying service to legitimate users. The vulnerability affects Next.js versions 15.0.0 up to 15.5.16 and 16.0.0 up to 16.2.5. The fix implemented involves treating the Next-Resume header as internal-only and stripping it from untrusted incoming requests to prevent external manipulation.

Attack Chain

1. The attacker identifies a Next.js application using Partial Prerendering and Cache Components.
2. The attacker crafts a malicious POST request targeted at a server action endpoint.
3. The malicious POST request includes a Next-Resume header, intended to exploit the partial prerendering mechanism.
4. The Next.js application, upon receiving the crafted request, enters a deadlock state while processing the request body.
5. The connection remains open and consumes server resources, including file descriptors.
6. The attacker sends multiple such malicious POST requests concurrently, amplifying the resource consumption.
7. The server’s capacity to handle new connections diminishes due to the exhausted resources.
8. Legitimate users are denied service as the server is unable to accept new connections or process their requests, resulting in a denial-of-service condition.

Impact

Successful exploitation of CVE-2026-44579 leads to a denial-of-service condition, rendering Next.js applications unavailable to legitimate users. The number of victims is directly proportional to the attacker’s ability to send concurrent malicious requests and the server’s capacity to handle connections. Sectors reliant on Next.js applications for critical services, such as e-commerce, content delivery, and web applications, are particularly vulnerable. The vulnerability can severely impact business operations, causing financial losses, reputational damage, and disruption of services.

Recommendation

• Upgrade Next.js to version 15.5.16 or later for the 15.x branch, or version 16.2.5 or later for the 16.x branch, to incorporate the fix for CVE-2026-44579.
• As a temporary workaround, block incoming requests containing the Next-Resume header at the edge to prevent exploitation until the upgrade can be performed (see Overview).
• Deploy the Sigma rule Detect Suspicious Next-Resume Header to identify potential exploitation attempts by monitoring for the presence of the Next-Resume header in incoming HTTP requests.
• Monitor web server access logs for a high volume of POST requests to server action endpoints, which could indicate an attempted denial-of-service attack, and correlate with the Next-Resume header to refine detection.

]]>mediumadvisorydenial-of-serviceconnection-exhaustionnext.jscve-2026-44579https://feed.craftedsignal.io/briefs/2026-05-nextjs-ssrf/Mon, 11 May 2026 15:56:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-nextjs-ssrf/Next.js applications using WebSocket upgrades are vulnerable to server-side request forgery (SSRF) through crafted WebSocket upgrade requests, allowing attackers to proxy requests to internal or external destinations, affecting self-hosted applications running versions npm/next (>= 13.4.13, < 15.5.16) and npm/next (>= 16.0.0, < 16.2.5).Next.js applications utilizing WebSocket upgrades are susceptible to a server-side request forgery (SSRF) vulnerability. This flaw allows an attacker to craft WebSocket upgrade requests, forcing the server to proxy requests to arbitrary internal or external destinations. This vulnerability is present in self-hosted Next.js applications using the built-in Node.js server. Vercel-hosted deployments are not affected. The vulnerability is present in versions npm/next (>= 13.4.13, < 15.5.16) and npm/next (>= 16.0.0, < 16.2.5). The fix involves applying the same safety checks to WebSocket upgrade handling that already existed for normal HTTP requests, ensuring upgrade requests are only proxied when routing has explicitly marked them as safe external rewrites. This issue is tracked as CVE-2026-44578.

Attack Chain

1. The attacker identifies a self-hosted Next.js application utilizing WebSocket upgrades.
2. The attacker crafts a malicious WebSocket upgrade request. This request contains a target destination (internal or external) to which the server will be forced to proxy the request.
3. The attacker sends the crafted WebSocket upgrade request to the Next.js server.
4. The Next.js server, lacking proper validation, processes the malicious upgrade request.
5. The server initiates a connection to the attacker-specified destination.
6. The server proxies data between the attacker and the target destination.
7. The attacker gains access to internal services, cloud metadata endpoints, or other sensitive resources.
8. The attacker exfiltrates sensitive information or leverages the access for further malicious activities.

Impact

Successful exploitation of this SSRF vulnerability (CVE-2026-44578) can lead to the exposure of internal services, cloud metadata endpoints, or other sensitive resources. Attackers can potentially gain unauthorized access to sensitive data or internal systems, leading to data breaches, privilege escalation, or further compromise of the affected infrastructure. The number of victims and the specific sectors targeted depend on the deployment and configurations of the vulnerable Next.js applications. Vercel-hosted deployments are not affected.

Recommendation

• Upgrade Next.js to a patched version (>= 15.5.16 or >= 16.2.5) to remediate the vulnerability as described in GHSA-c4j6-fc7j-m34r.
• Deploy the Sigma rule Detect Suspicious WebSocket Upgrade Requests to detect potential exploitation attempts by monitoring for suspicious target domains in WebSocket upgrade requests.
• If immediate upgrade is not possible, implement the suggested workarounds: do not expose the origin server directly to untrusted networks and block WebSocket upgrades at the reverse proxy or load balancer if they are not required, as described in GHSA-c4j6-fc7j-m34r.
• Restrict origin egress to internal networks and metadata services where possible, as recommended in GHSA-c4j6-fc7j-m34r.

]]>highadvisoryssrfcve-2026-44578next.jswebsocketserver-side request forgery