CVE-2026-44578

[CVE catalog]

Severity

High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Published

May 6, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

35.54% · Oct 25, 2026

A flaw was found in Next.js. Self-hosted applications utilizing the built-in Node.js server are vulnerable to Server-Side Request Forgery (SSRF) through specially crafted WebSocket upgrade requests. A remote attacker can exploit this by causing the server to proxy requests to arbitrary internal or external destinations. This could lead to the exposure of internal services or sensitive cloud metadata endpoints. Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests This Important severity flaw in Next.js affects self-hosted applications, including Red Hat AMQ, when using the built-in Node.js server. A remote attacker can exploit specially crafted WebSocket upgrade requests to perform Server-Side Request Forgery, potentially exposing internal network services or sensitive cloud metadata endpoints. This risk is specific to deployments where the origin server is directly exposed to untrusted networks. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.