Next.js: Server-side request forgery in applications using WebSocket upgrades
Title source: cnaExploitation Summary
EIP tracks 8 public exploits for CVE-2026-44578. PoCs published by dwisiswant0, ynsmroztas, dinosn. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains functional proof-of-concept exploits for multiple Next.js vulnerabilities, including SSRF, XSS, and DoS, with detailed technical analysis and patch diffs. The PoCs are structured for defensive research and regression testing.
Description
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
Exploits (8)
This repository contains functional proof-of-concept exploits for multiple Next.js vulnerabilities, including SSRF, XSS, and DoS, with detailed technical analysis and patch diffs. The PoCs are structured for defensive research and regression testing.
This repository contains a functional exploit for CVE-2026-44578, an SSRF vulnerability in Next.js WebSocket upgrade handler. The exploit includes both scanning and interactive shell capabilities for targeting cloud metadata services.
This repository contains a functional exploit for CVE-2026-44578, a Server-Side Request Forgery (SSRF) vulnerability in Next.js self-hosted deployments. The exploit leverages a flawed WebSocket upgrade handler to extract AWS credentials and internal service data from localhost:80.
This repository contains a functional exploit for CVE-2026-44578, a Server-Side Request Forgery (SSRF) vulnerability in Next.js. The exploit leverages a missing routing-completion check in the WebSocket upgrade handler, allowing unauthenticated attackers to send crafted HTTP/1.1 requests with absolute-form URIs to proxy requests to internal services.
This repository provides a detailed technical analysis of CVE-2026-44578, a high-severity SSRF vulnerability in Next.js. It includes affected versions, mitigation strategies, and example malicious requests, but lacks functional exploit code.
This repository contains Nuclei templates for detecting CVE-2026-44578, a Next.js WebSocket Upgrade Handler SSRF vulnerability. The templates validate SSRF behavior and metadata endpoint exposure across multiple cloud providers without extracting credentials.
This repository contains a functional PoC for CVE-2026-44578, an SSRF vulnerability in Next.js WebSocket upgrade handler. The exploit leverages WebSocket headers to tunnel requests to internal services, demonstrated with Redis and AWS metadata examples.
This repository contains a functional exploit PoC for CVE-2026-44578, an SSRF vulnerability in Next.js via WebSocket upgrade requests. The exploit demonstrates the vulnerability by sending crafted HTTP/1.1 WebSocket upgrade requests with absolute URLs, which can lead to SSRF to localhost services on the target machine.
Nuclei Templates (1)
http.component:"Next.js"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N