CVE-2026-29057 — Next.js Request Smuggling Lab

This repository is a focused presentation lab for CVE-2026-29057. It compares a vulnerable Next.js target (15.5.12) with the patched release (15.5.13) using the same topology and raw HTTP payload.

Use it only in an isolated lab. Request-desynchronization probes can disrupt shared connections in real environments.

Attribution

This repository is adapted from Nayaka Ghana Subrata's original Next.js Proof of Concept repository. Full credit goes to the original author for the foundational proof-of-concept work.

I reorganized and modified that work to focus specifically on CVE-2026-29057, including the presentation materials, guided demonstration, lab scenario, explanatory comments, and vulnerable-versus-patched comparison. This repository is an educational adaptation and should not be mistaken for the original author's repository.

Presentation

• CVE-2026-29057 presentation slides
• Presentation script
• Demo runbook
• Presenter Q&A

What the lab proves

1. The client sends one chunked DELETE /api/workspace/tasks/1042 request.
2. Its body contains bytes spelling a second request: GET /secret.
3. The vulnerable proxy removes Transfer-Encoding and adds Content-Length: 0, while body bytes are still forwarded.
4. The internal intermediary parses the remaining bytes as a second request and forwards both parsed requests to the application backend.

Target	Next.js	Backend requests
Vulnerable	15.5.12	DELETE /api/workspace/tasks/1042, then GET /secret
Patched	15.5.13	DELETE /api/workspace/tasks/1042 only

Repository layout

.
├── docker-compose.yml
├── DEMO-RUNBOOK.md
├── PRESENTATION-SCRIPT.md
├── PRESENTATION-QA.md
├── pocs/cve-2026-29057/
│   ├── app/
│   ├── support/server.js
│   ├── next.config.js
│   └── Dockerfile
└── scripts/run-cve-2026-29057.mjs

Start the lab

Requirements: Docker Compose and Node.js 18 or newer.

docker compose up --build cve-2026-29057-vuln cve-2026-29057-fixed

• Vulnerable: http://localhost:3105
• Patched: http://localhost:3106

Run the differential demonstration

node scripts/run-cve-2026-29057.mjs http://localhost:3105
node scripts/run-cve-2026-29057.mjs http://localhost:3106

Expected vulnerable evidence:

[after] {"backendRequests":["DELETE /api/workspace/tasks/1042","GET /secret"],"flag":"FLAG{one_stream_two_requests}"}
PoC result: vulnerable behavior reproduced.
Flag: FLAG{one_stream_two_requests}

Expected patched evidence:

[after] {"backendRequests":["DELETE /api/workspace/tasks/1042"],"flag":null}
PoC result: smuggled request was not observed. This usually means the target is patched.

The meaningful evidence is differential: topology and payload stay unchanged; only the Next.js version differs.

Black-box discovery story

The lab does not require the presenter to pretend that an attacker magically knows both paths:

1. The page visibly labels Launch brief as Task #1042. Click Delete task while browsing through Burp. Proxy history shows the legitimate DELETE /api/workspace/tasks/1042 request, so the carrier path comes directly from normal application traffic.
2. Request /robots.txt. It points to the accidentally deployed /ops/release-manifest artifact.
3. Request that manifest. It identifies /api/workspace/ as the public service prefix, leaks /secret as an internal route, and names /api/state as the request log. It does not reveal the flag itself.

The manifest is a deliberate information-disclosure weakness for the lab narrative. It is separate from CVE-2026-29057; the CVE supplies the request-framing bypass that reaches the disclosed backend route.

The route names are lab fixtures, not paths recovered from a real victim. Vercel's official patch added a regression test that defines /rewrites/:path*, uses /rewrites/poc as the carrier, and creates /secret on the test backend. This lab gives the carrier a product-shaped name while preserving that test structure.

Code walkthrough order

1. docker-compose.yml — vulnerable versus patched versions.
2. pocs/cve-2026-29057/next.config.js — external rewrite boundary.
3. pocs/cve-2026-29057/support/server.js — intermediary and backend parsers.
4. scripts/run-cve-2026-29057.mjs — raw chunked payload and result checker.
5. pocs/cve-2026-29057/app/api/ — evidence reset and read endpoints.

Stop the lab

docker compose down

Sources

• GitHub Security Advisory GHSA-ggv3-7p47-pfv8
• Next.js patch commit
• NVD record