Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

The version of Next.js installed on the remote host is 13.4.13 prior to 15.5.16 or 16.0.0 prior to 16.2.5. It is, therefore, affected by a Server-Side Request Forgery vulnerability in the WebSocket upgrade handler that allows unauthenticated GET-only SSRF to any host on port 80 reachable from the server.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115242	Next.js 16.0.x < 16.2.5 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high
115241	Next.js 13.4.13 < 15.5.16 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2026-44578

high

Tenable Plugins

high

high