Docker-based lab reproducing CVE-2026-29057 Next.js request smuggling, comparing vulnerable 15.5.12 against patched 15.5.13 with a raw chunked HTTP payload.
This repository is a focused presentation lab for CVE-2026-29057. It compares a vulnerable Next.js target (15.5.12) with the patched release (15.5.13) using the same topology and raw HTTP payload.
Use it only in an isolated lab. Request-desynchronization probes can disrupt shared connections in real environments.
This repository is adapted from Nayaka Ghana Subrata's original Next.js Proof of Concept repository. Full credit goes to the original author for the foundational proof-of-concept work.
I reorganized and modified that work to focus specifically on CVE-2026-29057, including the presentation materials, guided demonstration, lab scenario, explanatory comments, and vulnerable-versus-patched comparison. This repository is an educational adaptation and should not be mistaken for the original author's repository.
DELETE /api/workspace/tasks/1042 request.GET /secret.Transfer-Encoding and adds Content-Length: 0, while body bytes are still forwarded.| Target | Next.js | Backend requests |
|---|---|---|
| Vulnerable | 15.5.12 | DELETE /api/workspace/tasks/1042, then GET /secret |
| Patched | 15.5.13 | DELETE /api/workspace/tasks/1042 only |
.
├── docker-compose.yml
├── DEMO-RUNBOOK.md
├── PRESENTATION-SCRIPT.md
├── PRESENTATION-QA.md
├── pocs/cve-2026-29057/
│ ├── app/
│ ├── support/server.js
│ ├── next.config.js
│ └── Dockerfile
└── scripts/run-cve-2026-29057.mjs
Requirements: Docker Compose and Node.js 18 or newer.
docker compose up --build cve-2026-29057-vuln cve-2026-29057-fixed
node scripts/run-cve-2026-29057.mjs http://localhost:3105
node scripts/run-cve-2026-29057.mjs http://localhost:3106
Expected vulnerable evidence:
[after] {"backendRequests":["DELETE /api/workspace/tasks/1042","GET /secret"],"flag":"FLAG{one_stream_two_requests}"}
PoC result: vulnerable behavior reproduced.
Flag: FLAG{one_stream_two_requests}
Expected patched evidence:
[after] {"backendRequests":["DELETE /api/workspace/tasks/1042"],"flag":null}
PoC result: smuggled request was not observed. This usually means the target is patched.
The meaningful evidence is differential: topology and payload stay unchanged; only the Next.js version differs.
The lab does not require the presenter to pretend that an attacker magically knows both paths:
DELETE /api/workspace/tasks/1042 request, so the carrier path comes directly from normal application traffic./robots.txt. It points to the accidentally deployed /ops/release-manifest artifact./api/workspace/ as the public service prefix, leaks /secret as an internal route, and names /api/state as the request log. It does not reveal the flag itself.The manifest is a deliberate information-disclosure weakness for the lab narrative. It is separate from CVE-2026-29057; the CVE supplies the request-framing bypass that reaches the disclosed backend route.
The route names are lab fixtures, not paths recovered from a real victim. Vercel's official patch added a regression test that defines /rewrites/:path*, uses /rewrites/poc as the carrier, and creates /secret on the test backend. This lab gives the carrier a product-shaped name while preserving that test structure.
docker-compose.yml — vulnerable versus patched versions.pocs/cve-2026-29057/next.config.js — external rewrite boundary.pocs/cve-2026-29057/support/server.js — intermediary and backend parsers.scripts/run-cve-2026-29057.mjs — raw chunked payload and result checker.pocs/cve-2026-29057/app/api/ — evidence reset and read endpoints.docker compose down