CVE-2026-44578
HighNext.js vulnerable to server-side request forgery in applications using WebSocket upgrades
Published May 11, 2026 · Updated Sep 28, 2026 · Also known as GHSA-c4j6-fc7j-m34r, ROOT-APP-NPM-CVE-2026-44578
Key Facts
Patch in the next maintenance window- CVE-2026-44578 is a high-severity vulnerability (CVSS 8.6 v3.1) affecting Next.js (Vercel), keep (chainguard), peerdb-ui (minimos) and 7 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 1.9% probability of exploitation in the next 30 days.
- Fixed versions are available, including @rootio/next 13.4.19-root.io.3, @rootio/next 13.4.19-root.io.4, @rootio/next 13.4.19-root.io.5.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
1.9%
Higher than 79.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-44578 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
Affected Products
15 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Next.jsVercel | >= >= 16.0.0, < 16.2.5 | 15.5.16 |
| keepchainguard | See advisory | 0.51.0-r7 |
| peerdb-uiminimos | See advisory | 0.36.25-r0 |
| nextnpm | >= 13.4.13 | 16.2.5 |
| rhtas/rekor-search-ui-rhel9:1783327185redhat | See advisory | n/a |
Patched Releases
@rootio/next
13.4.19-root.io.3, 13.4.19-root.io.4, 13.4.19-root.io.5, 13.4.19-root.io.6, 13.4.19-root.io.7, 13.5.11-root.io.6, 13.5.11-root.io.7, 13.5.11-root.io.8, 13.5.11-root.io.9, 13.5.4-root.io.2, 13.5.4-root.io.3, 13.5.4-root.io.4, 13.5.4-root.io.5, 13.5.4-root.io.6, 13.5.6-root.io.5, 13.5.6-root.io.6, 13.5.6-root.io.7, 14.0.0-root.io.2, 14.0.0-root.io.3, 14.0.0-root.io.4, 14.0.0-root.io.5, 14.0.0-root.io.6, 14.0.0-root.io.7, 14.0.3-root.io.2, 14.0.3-root.io.3, 14.0.3-root.io.4, 14.0.3-root.io.5, 14.0.3-root.io.6, 14.0.4-root.io.5, 14.0.4-root.io.6, 14.0.4-root.io.7, 14.0.4-root.io.8, 14.0.4-root.io.9, 14.1.0-root.io.1, 14.1.0-root.io.2, 14.1.0-root.io.3, 14.1.0-root.io.4, 14.1.0-root.io.5, 14.1.0-root.io.6, 14.1.0-root.io.7, 14.1.0-root.io.8, 14.1.3-root.io.1, 14.1.3-root.io.2, 14.1.3-root.io.3, 14.1.3-root.io.4, 14.1.3-root.io.5, 14.1.3-root.io.6, 14.1.3-root.io.7, 14.1.3-root.io.8, 14.1.4-root.io.1, 14.1.4-root.io.2, 14.1.4-root.io.3, 14.1.4-root.io.4, 14.1.4-root.io.5, 14.1.4-root.io.6, 14.1.4-root.io.7, 14.1.4-root.io.8, 14.1.4-root.io.9, 14.2.0-root.io.2, 14.2.0-root.io.3, 14.2.0-root.io.4, 14.2.0-root.io.5, 14.2.0-root.io.6, 14.2.10-root.io.1, 14.2.10-root.io.2, 14.2.10-root.io.3, 14.2.10-root.io.4, 14.2.13-root.io.3, 14.2.13-root.io.4, 14.2.15-root.io.2, 14.2.15-root.io.3, 14.2.15-root.io.4, 14.2.15-root.io.5, 14.2.15-root.io.6, 14.2.16-root.io.2, 14.2.16-root.io.3, 14.2.16-root.io.4, 14.2.16-root.io.5, 14.2.16-root.io.6, 14.2.18-root.io.1, 14.2.18-root.io.2, 14.2.18-root.io.3, 14.2.18-root.io.4, 14.2.18-root.io.5, 14.2.18-root.io.6, 14.2.2-root.io.6, 14.2.2-root.io.7, 14.2.2-root.io.8, 14.2.2-root.io.9, 14.2.21-root.io.2, 14.2.21-root.io.3, 14.2.21-root.io.4, 14.2.21-root.io.5, 14.2.21-root.io.6, 14.2.24-root.io.2, 14.2.25-root.io.1, 14.2.25-root.io.2, 14.2.26-root.io.2, 14.2.26-root.io.3, 14.2.26-root.io.4, 14.2.26-root.io.5, 14.2.26-root.io.6, 14.2.28-root.io.1, 14.2.28-root.io.2, 14.2.28-root.io.3, 14.2.28-root.io.4, 14.2.28-root.io.5, 14.2.29-root.io.1, 14.2.29-root.io.2, 14.2.29-root.io.3, 14.2.29-root.io.4, 14.2.29-root.io.5, 14.2.3-root.io.2, 14.2.3-root.io.3, 14.2.3-root.io.4, 14.2.3-root.io.5, 14.2.30-root.io.10, 14.2.30-root.io.3, 14.2.30-root.io.4, 14.2.30-root.io.5, 14.2.30-root.io.6, 14.2.30-root.io.7, 14.2.30-root.io.8, 14.2.30-root.io.9, 14.2.31-root.io.2, 14.2.31-root.io.3, 14.2.31-root.io.4, 14.2.31-root.io.5, 14.2.32-root.io.3, 14.2.32-root.io.4, 14.2.32-root.io.5, 14.2.32-root.io.6, 14.2.32-root.io.7, 14.2.32-root.io.8, 14.2.33-root.io.1, 14.2.33-root.io.2, 14.2.33-root.io.3, 14.2.33-root.io.4, 14.2.33-root.io.5, 14.2.33-root.io.6, 14.2.35-root.io.2, 14.2.35-root.io.3, 14.2.35-root.io.4, 14.2.35-root.io.5, 14.2.35-root.io.6, 14.2.35-root.io.7, 14.2.35-root.io.8, 14.2.35-root.io.9, 14.2.5-root.io.10, 14.2.5-root.io.3, 14.2.5-root.io.4, 14.2.5-root.io.5, 14.2.5-root.io.6, 14.2.5-root.io.7, 14.2.5-root.io.8, 14.2.5-root.io.9, 15.5.10-root.io.1, 15.5.10-root.io.2, 15.5.10-root.io.3, 15.5.10-root.io.4, 15.5.10-root.io.5, 15.5.10-root.io.6, 15.5.15-root.io.1, 15.5.15-root.io.2, 15.5.15-root.io.3, 15.5.15-root.io.4, 16.1.6-root.io.3, 16.1.6-root.io.4, 16.1.6-root.io.5, 16.1.6-root.io.6, 16.1.6-root.io.7, 16.1.6-root.io.8, 16.1.7-root.io.1, 16.1.7-root.io.2, 16.1.7-root.io.3, 16.2.5-root.io.1, 16.2.5-root.io.2, 16.2.5-root.io.3
@rootio/Next.js
15.5.10-root.io.1, 15.5.10-root.io.2
@seal-security/next
16.0.6-sp999
keep
0.51.0-r7
next
13.4.19-aikido.3, 13.4.19-aikido.4, 13.4.19-aikido.5, 13.4.19-aikido.6, 13.4.19-aikido.7, 13.5.11-aikido.6, 13.5.11-aikido.7, 13.5.11-aikido.8, 13.5.11-aikido.9, 13.5.4-aikido.2, 13.5.4-aikido.3, 13.5.4-aikido.4, 13.5.4-aikido.5, 13.5.4-aikido.6, 13.5.6-aikido.5, 13.5.6-aikido.6, 13.5.6-aikido.7, 14.0.0-aikido.2, 14.0.0-aikido.3, 14.0.0-aikido.4, 14.0.0-aikido.5, 14.0.0-aikido.6, 14.0.0-aikido.7, 14.0.3-aikido.2, 14.0.3-aikido.3, 14.0.3-aikido.4, 14.0.3-aikido.5, 14.0.3-aikido.6, 14.0.4-aikido.5, 14.0.4-aikido.6, 14.0.4-aikido.7, 14.0.4-aikido.8, 14.0.4-aikido.9, 14.1.0-aikido.1, 14.1.0-aikido.2, 14.1.0-aikido.3, 14.1.0-aikido.4, 14.1.0-aikido.5, 14.1.0-aikido.6, 14.1.0-aikido.7, 14.1.0-aikido.8, 14.1.3-aikido.1, 14.1.3-aikido.2, 14.1.3-aikido.3, 14.1.3-aikido.4, 14.1.3-aikido.5, 14.1.3-aikido.6, 14.1.3-aikido.7, 14.1.3-aikido.8, 14.1.4-aikido.1, 14.1.4-aikido.2, 14.1.4-aikido.3, 14.1.4-aikido.4, 14.1.4-aikido.5, 14.1.4-aikido.6, 14.1.4-aikido.7, 14.1.4-aikido.8, 14.1.4-aikido.9, 14.2.0-aikido.2, 14.2.0-aikido.3, 14.2.0-aikido.4, 14.2.0-aikido.5, 14.2.0-aikido.6, 14.2.10-aikido.1, 14.2.10-aikido.2, 14.2.10-aikido.3, 14.2.10-aikido.4, 14.2.13-aikido.3, 14.2.13-aikido.4, 14.2.15-aikido.2, 14.2.15-aikido.3, 14.2.15-aikido.4, 14.2.15-aikido.5, 14.2.15-aikido.6, 14.2.16-aikido.2, 14.2.16-aikido.3, 14.2.16-aikido.4, 14.2.16-aikido.5, 14.2.16-aikido.6, 14.2.18-aikido.1, 14.2.18-aikido.2, 14.2.18-aikido.3, 14.2.18-aikido.4, 14.2.18-aikido.5, 14.2.18-aikido.6, 14.2.2-aikido.6, 14.2.2-aikido.7, 14.2.2-aikido.8, 14.2.2-aikido.9, 14.2.21-aikido.2, 14.2.21-aikido.3, 14.2.21-aikido.4, 14.2.21-aikido.5, 14.2.21-aikido.6, 14.2.24-aikido.2, 14.2.25-aikido.1, 14.2.25-aikido.2, 14.2.26-aikido.2, 14.2.26-aikido.3, 14.2.26-aikido.4, 14.2.26-aikido.5, 14.2.26-aikido.6, 14.2.28-aikido.1, 14.2.28-aikido.2, 14.2.28-aikido.3, 14.2.28-aikido.4, 14.2.28-aikido.5, 14.2.29-aikido.1, 14.2.29-aikido.2, 14.2.29-aikido.3, 14.2.29-aikido.4, 14.2.29-aikido.5, 14.2.3-aikido.2, 14.2.3-aikido.3, 14.2.3-aikido.4, 14.2.3-aikido.5, 14.2.30-aikido.10, 14.2.30-aikido.3, 14.2.30-aikido.4, 14.2.30-aikido.5, 14.2.30-aikido.6, 14.2.30-aikido.7, 14.2.30-aikido.8, 14.2.30-aikido.9, 14.2.31-aikido.2, 14.2.31-aikido.3, 14.2.31-aikido.4, 14.2.31-aikido.5, 14.2.32-aikido.3, 14.2.32-aikido.4, 14.2.32-aikido.5, 14.2.32-aikido.6, 14.2.32-aikido.7, 14.2.32-aikido.8, 14.2.33-aikido.1, 14.2.33-aikido.2, 14.2.33-aikido.3, 14.2.33-aikido.4, 14.2.33-aikido.5, 14.2.33-aikido.6, 14.2.35-aikido.2, 14.2.35-aikido.3, 14.2.35-aikido.4, 14.2.35-aikido.5, 14.2.35-aikido.6, 14.2.35-aikido.7, 14.2.35-aikido.8, 14.2.35-aikido.9, 14.2.5-aikido.10, 14.2.5-aikido.3, 14.2.5-aikido.4, 14.2.5-aikido.5, 14.2.5-aikido.6, 14.2.5-aikido.7, 14.2.5-aikido.8, 14.2.5-aikido.9, 15.5.10-aikido.1, 15.5.10-aikido.2, 15.5.10-aikido.3, 15.5.10-aikido.4, 15.5.10-aikido.5, 15.5.10-aikido.6, 15.5.15-aikido.2, 15.5.15-aikido.3, 15.5.15-aikido.4, 15.5.16, 16.0.6-sp999, 16.1.6-aikido.4, 16.1.6-aikido.5, 16.1.6-aikido.6, 16.1.6-aikido.7, 16.1.6-aikido.8, 16.1.7-aikido.1, 16.1.7-aikido.2, 16.1.7-aikido.3, 16.2.5, 16.2.5-aikido.1, 16.2.5-aikido.2, 16.2.5-aikido.3
Next.js
15.5.10-aikido.1, 15.5.10-aikido.2, 15.5.16, 16.2.5
peerdb-ui
0.36.25-r0
Timeline
Publicly disclosed
May 11, 2026
Last updated
Sep 28, 2026
Weakness Type
- CWE-918 Server-Side Request Forgery (SSRF)
References
- advisoryRHSA-2026:37272
- advisoryRHSA-2026:40974
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44578.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-44578
FAQ
Common Questions.
Next.js is a React framework for building full-stack web applications.
Affected: Next.js (Vercel) versions >= >= 16.0.0, < 16.2.5; keep (chainguard); peerdb-ui (minimos), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including @rootio/next 13.4.19-root.io.3, @rootio/next 13.4.19-root.io.4, @rootio/next 13.4.19-root.io.5.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-44578 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo