CVE-2026-44578 in Next.js 16.1.1
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
- Severity
- High 8.6
- Exploitation
-
36% chance of exploit
in the next 30 days - Fix
- Update to 16.2.5
- Where
- App / API
- How it matched
- Exact version match
- Also known as
- GHSA-c4j6-fc7j-m34r
- First seen
- 2026-11-05 01:13:58 UTC
- Source
- https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r