🚨 CVE-2026-44578 — Next.js SSRF Vulnerability

📌 Overview

CVE-2026-44578 is a high-severity Server-Side Request Forgery (SSRF) vulnerability affecting self-hosted Next.js applications.

Attackers can exploit crafted WebSocket Upgrade Requests to force the server into making outbound requests to internal or external systems.

⚠️ Impact

This vulnerability may allow attackers to access:

🧠 Attack Flow

Attacker
   │
   ▼
Crafted WebSocket Upgrade Request
   │
   ▼
Next.js Server
   │
   ├──► Internal APIs
   ├──► Cloud Metadata Services
   ├──► Admin Interfaces
   └──► Other Internal Resources

📦 Affected Versions

🛡 Mitigation

✅ Immediate Actions

• Upgrade Next.js immediately
• Restrict outbound traffic
• Block metadata endpoints (169.254.169.254)
• Filter malicious upgrade headers
• Avoid exposing raw next start directly

🔥 Example Malicious Request

GET ws://169.254.169.254/ HTTP/1.1
Host: 169.254.169.254
Upgrade: websocket
Connection: Upgrade

🧪 Detection Ideas

grep -i "upgrade: websocket" access.log

grep "169.254.169.254" access.log

Monitor for:

• Unexpected outbound requests
• Internal IP targeting
• Suspicious WebSocket upgrades
• Metadata service access attempts

🔧 Recommended Reverse Proxy Protection

NGINX Example

if ($http_upgrade = "websocket") {
    return 403;
}

📚 References

🚀 Upgrade Immediately

Protect Internal Infrastructure Before Exploitation