IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.6High

CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgrades

vercel next.js; Red Hat Streams for Apache Kafka 2.9.4; Red Hat Red Hat Trusted Artifact Signer 1.3; Red Hat Red Hat Trusted Artifact Signer 1.4 Published: (6 months ago)

Description

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

Weakness (CWE): CWE-918

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
amq streams 2.9 —
Red Hat Red Hat Enterprise Linux 10 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux 9 —
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 all versions
Red Hat Red Hat Trusted Artifact Signer 1.3 all versions
Red Hat Red Hat Trusted Artifact Signer 1.4 all versions
Red Hat Streams for Apache Kafka 2.9.4 —
Red Hat streams for Apache Kafka 3 all versions
trusted artifact signer 1.3 —
trusted artifact signer 1.4 —
vercel next.js >= 16.0.0, < 16.2.5, >= 13.4.13, < 15.5.16

References and patches

CPE matches (NVD) (2)
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 13.4.13 < 15.5.16
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* ≥ 16.0.0 < 16.2.5

Recent CVEs in the same product — Red Hat Enterprise Linux

7.3High
CVE-2026-91151

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it ca…

7.8High
CVE-2026-108472

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…

7.5High
CVE-2026-91150

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…