Executive brief
Next.js is a popular web framework used to build and deploy web applications. When configured to rewrite requests to external backend services, a vulnerability in how it handles certain HTTP requests could allow an attacker to bypass routing rules and send requests to unintended backend endpoints (such as internal administrative routes). This could lead to unauthorized access to sensitive features or data.
Technical details
This vulnerability is an HTTP request smuggling flaw (CWE-444) affecting Next.js versions 9.5.0 through 15.5.12 and 16.0.0-beta.0 through 16.1.6. An attacker can craft a DELETE or OPTIONS request with Transfer-Encoding: chunked to a rewritten route, causing disagreement between Next.js and the backend server on where the HTTP request boundary lies. This allows smuggling of a second request to unintended backend routes. The attack is network-reachable with low complexity and no authentication required. The root cause lies in how an upstream library vendored by Next.js handles Content-Length and Transfer-Encoding headers. The fix ensures Content-Length: 0 is added only when both headers are absent, and prevents removal of Transfer-Encoding in this code path. Patches are available in Next.js versions 15.5.13 and 16.1.7. Applications hosted on Vercel's CDN are not affected since rewrites are handled at the edge level.
Affected products
- Vercel Next.js >=9.5.0, <15.5.13 and >=16.0.0-beta.0, <16.1.7
Timeline
- 2026-03-17: disclosed
- 2026-03-17: patched: Fixed in versions 15.5.13 and 16.1.7