Server-side Request Forgery (SSRF) Affecting next package, versions >=13.4.13-canary.0 <15.5.16>=16.0.0-beta.0 <16.2.5
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-NEXT-16638682
- published11 May 2026
- disclosed11 May 2026
- creditUnknown
Introduced: 11 May 2026
NewCVE-2026-44578 (opens in a new tab)How to fix?
Upgrade next to version 15.5.16, 16.2.5 or higher.
Overview
next is a react framework.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via crafted WebSocket upgrade requests. An attacker can access internal or external resources by sending specially crafted requests with absolute-url that cause the server to proxy connections to arbitrary destinations, potentially exposing sensitive internal services or cloud metadata endpoints.
Workaround
This vulnerability can be mitigated by not exposing the origin server directly to untrusted networks, blocking WebSocket upgrades at the reverse proxy or load balancer if not required, and restricting origin egress to internal networks and metadata services where possible.