Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and     16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side     request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy     requests to arbitrary internal or external destinations, which may expose internal services or cloud     metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and     16.2.5. (CVE-2026-44578)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Next.js installed on the remote host is 13.4.13 prior to 15.5.16 or 16.0.0 prior to 16.2.5. It is, therefore, affected by a Server-Side Request Forgery vulnerability in the WebSocket upgrade handler that allows unauthenticated GET-only SSRF to any host on port 80 reachable from the server.

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Severity
318352	Linux Distros Unpatched Vulnerability : CVE-2026-44578	Nessus	Misc.	high
115242	Next.js 16.0.x < 16.2.5 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	high
115241	Next.js 13.4.13 < 15.5.16 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2026-44578

high

Tenable Plugins

high

high

high