CVE-2026-44578 is a Server-Side Request Forgery (SSRF) vulnerability in Next.js affecting self-hosted applications using the built-in Node.js server. The flaw arises from the server's handling of crafted WebSocket upgrade requests, which can be exploited by remote attackers to make the server proxy requests to arbitrary internal or external destinations. This can lead to exposure of internal network services or sensitive cloud metadata endpoints. The vulnerability affects Next.js versions >=13.4.13 <15.5.16 and >=16.0.0 <16.2.5. Vercel-hosted deployments are not vulnerable. The vulnerability has a CVSS v3.1 base score of 8.6 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, and a changed scope with high confidentiality impact. Red Hat advisories confirm the vulnerability and note that no suitable mitigation is currently available, recommending upgrading to fixed versions 15.5.16 and 16.2.5.

An attacker can exploit this SSRF vulnerability to make the vulnerable Next.js server proxy requests to arbitrary destinations, potentially exposing internal services or sensitive cloud metadata endpoints that are otherwise inaccessible. This can lead to confidentiality breaches of internal network resources. The vulnerability does not impact integrity or availability. The attack requires no privileges or user interaction and can be performed remotely over the network.

The vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users of affected versions should upgrade to these fixed versions to remediate the issue. Red Hat advisories indicate that no effective mitigation other than upgrading currently meets their criteria. Vercel-hosted deployments are not affected and require no action. Check the vendor advisory for the latest remediation guidance.