CVE-2026-44578 is a server-side request forgery (SSRF) vulnerability (CWE-918) affecting self-hosted Next.js applications using the built-in Node.js server in versions >=13.4.13 <15.5.16 and >=16.0.0 <16.2.5. The vulnerability arises from crafted WebSocket upgrade requests that cause the server to proxy requests to arbitrary destinations, including internal services or cloud metadata endpoints. This can lead to unauthorized access to sensitive internal resources. Vercel-hosted deployments are not vulnerable. The issue is resolved in Next.js versions 15.5.16 and 16.2.5. According to the Red Hat advisory, no direct fixes are listed in their Trusted Artifact Signer product, but the advisory confirms the vulnerability and references the fixed versions. Patch status is not explicitly stated in the advisory content provided, so users should upgrade to the fixed versions.

An attacker can exploit this SSRF vulnerability to make the Next.js server proxy requests to arbitrary internal or external endpoints. This may expose sensitive internal services or cloud metadata endpoints, potentially leading to information disclosure. The vulnerability does not impact Vercel-hosted deployments. The CVSS v3.1 score is 8.6 (High), indicating a high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Upgrade affected Next.js self-hosted applications to version 15.5.16 or later, or 16.2.5 or later, where this SSRF vulnerability is fixed. Vercel-hosted deployments are not affected and require no action. Patch status is not explicitly confirmed in the vendor advisory, so users should verify with the official Next.js release notes or vendor advisories for the latest remediation guidance.