Is CVE-2026-44578 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44578 being exploited in the wild.

How severe is CVE-2026-44578?

High severity, with a CVSS score of 8.6, published 13 May 2026.

Which products and versions are affected?

next (npm) SEMVER:introduced=13.4.13,fixed=15.5.16; Vercel Next.js >= 13.4.13, = 16.0.0, < 16.2.5.

Is there a fix for CVE-2026-44578?

Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44578 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44578?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44578: Vercel Next.js SSRF via WebSocket upgrade requests

Q: Is there a fix for CVE-2026-44578?

Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44578 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44578?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44578 · Severity: high · CVSS 8.6 · Published 2026-05-13

Next.js is a popular framework used to build and host web applications. A security flaw in its built-in server allows attackers to trick the application into making unauthorized requests to internal systems or cloud management services. This could lead to the exposure of sensitive internal data or administrative credentials, though applications hosted directly on the Vercel platform are not affected.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-44578 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44578 being exploited in the wild.
How severe is CVE-2026-44578?: High severity, with a CVSS score of 8.6, published 13 May 2026.
Which products and versions are affected?: next (npm) SEMVER:introduced=13.4.13,fixed=15.5.16; Vercel Next.js >= 13.4.13, < 15.5.16; >= 16.0.0, < 16.2.5.
Is there a fix for CVE-2026-44578?: Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44578 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44578?: Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 15.5.16 or later
```
npm install next@15.5.16
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Next.js when using the built-in Node.js server for self-hosting. The flaw is located in the handling of WebSocket upgrade requests, which fail to undergo the same safety checks applied to standard HTTP requests. A remote, unauthenticated attacker can send a specially crafted upgrade request to force the server to proxy traffic to arbitrary internal or external destinations. This can be used to bypass network segmentation and access internal services or cloud metadata endpoints (e.g., IMDS). The issue is fixed in versions 15.5.16 and 16.2.5.

Affected products

Vercel Next.js >= 13.4.13, < 15.5.16; >= 16.0.0, < 16.2.5

Identifiers

CVE-2026-44578
GHSA-c4j6-fc7j-m34r

Timeline

2026-05-06: advisory: GitHub advisory published by Vercel
2026-05-13: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.