CVE-2026-44578 Explained: Next.js WebSocket Upgrade SSRF Vulnerability

CVE-2026-44578 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting self-hosted Next.js versions 13.4.13 through 15.5.15 and 16.0.0 through 16.2.4, allowing attackers to access internal services via the WebSocket upgrade handler. This flaw, patched by Vercel on May 11, 2026, is not present in Vercel-hosted apps but poses a significant risk to self-hosted environments, especially those lacking a reverse proxy. The vulnerability exploits a routing asymmetry where the WebSocket upgrade handler neglects certain safety checks, enabling crafted GET requests to reach internal services, including AWS Instance Metadata Service (IMDS). To mitigate the risk, affected deployments should upgrade to Next.js 15.5.18 or 16.2.6, employ reverse proxy defenses, and enforce IMDSv2 to prevent unauthorized metadata access. The vulnerability highlights the importance of scrutinizing framework-level request handling alongside application code to ensure comprehensive security, especially in setups where a Next.js frontend interfaces with a backend CMS like Strapi.