CVE-2026-44578: exploitation status and patch state
CVE-2026-44578 · CVSS 8.6 HIGH · EPSS 39%
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
Is CVE-2026-44578 exploited?
Not in the CISA KEV catalog.
EPSS puts exploitation in the next 30 days at 39%.
Public exploit code: none found in monitored sources.
Public detection rules exist.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2026-44578
PlainSec has not published a story about this CVE.