nextjs-cve-2026-44578

Nuclei templates for detecting CVE-2026-44578 (Next.js WebSocket Upgrade SSRF) with multi-cloud metadata validation, Next.js fingerprinting, and real-world scanning workflows. Includes references to the original NextSSRF research and exploit tooling.

NextSSRF Nuclei Templates

Nuclei templates for detecting CVE-2026-44578 — a Next.js WebSocket Upgrade Handler SSRF vulnerability affecting vulnerable self-hosted Next.js deployments.

Detection Examples

Nuclei Output

!!EXPLOIT!! Metadata Detection

This repository contains Nuclei-based detection templates.

Included

• Multi-cloud SSRF detection templates
• Next.js fingerprinting templates
• Safe metadata validation checks
• Workflow templates for Nuclei

Supported cloud providers:

• AWS
• Azure
• GCP
• DigitalOcean
• Oracle OCI

Detection Logic

The templates use malformed absolute-URI requests together with:

Connection: Upgrade
Upgrade: websocket

to trigger the vulnerable WebSocket upgrade handling logic in affected Next.js deployments.

The detection templates validate:

• SSRF behavior
• Metadata endpoint exposure
• Proxy fingerprints
• Cloud-specific response indicators

without extracting credentials or secrets.

Original Exploit Tool

Credits to the original researchers and tooling authors:

• ynsmroztas/nextssrf

Safe Usage

These templates are intended only for:

• authorized security testing
• bug bounty programs
• defensive validation
• asset inventory verification

Only scan systems you own or have explicit permission to test.

Disclaimer

This repository is provided for educational and authorized security testing purposes only.

The maintainers are not responsible for misuse, unauthorized scanning, or illegal activity performed using these templates.