Home / Vulnerability Intelligence / CVE-2026-44578

CVE-2026-44578 - Vulnerability Analysis

HighCVSS: 8.6

Last Updated: May 14, 2026

Next.js - Server-Side Request Forgery

Published: May 13, 2026Updated: May 14, 2026PoC AvailableRemote Exploitable

Overview

Next.js 13.4.13 to before 15.5.16 and 16.2.5 contains a server-side request forgery caused by crafted WebSocket upgrade requests in the built-in Node.js server, letting attackers proxy requests to arbitrary destinations, exploit requires self-hosted deployment.

Severity & Score

Severity: High

CVSS Score: 8.6

EPSS Score: 3.2%(Probability of exploitation in next 30 days)

Impact

Attackers can proxy requests to internal or external services, exposing sensitive internal resources or cloud metadata endpoints.

Mitigation

Upgrade to versions 15.5.16 or 16.2.5 or later.

References

https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

May 13, 2026

🟠 CVE-2026-44578 - High (8.6) Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44578/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

May 13, 2026

View original post

GitHub Repositories(2 repos)

Related Resources

Details

CVE ID: CVE-2026-44578
Severity: High
CVSS Score: 8.6
Type: server_side_request_forgery
Status: confirmed
EPSS: 3.2%
Social Posts: 2

CWE

CWE-918

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score

3.2%Probability of exploitation in the next 30 days