dinosn/cve-2026-44578

This repository documents and demonstrates CVE-2026-44578, a security vulnerability found in self-hosted Next.js deployments. It is a security research project, not an app for end users, it exists to explain the bug, prove it works, and let researchers or defenders test it safely in an isolated lab. The vulnerability lives in the WebSocket upgrade handling code inside Next.js's router server. Normally, when Next.js decides whether to forward, or proxy, an incoming request to another address, it checks that routing has actually finished before doing so. The buggy code path skipped that check for WebSocket upgrade requests. Combined with how Next.js cleans up repeated slashes in a URL, a specially crafted request using a URL like http:/// gets its hostname stripped out entirely, and the proxy code then quietly connects to localhost port 80 instead. If anything sensitive happens to be listening there, such as a cloud provider's metadata service that hands out temporary AWS credentials, an attacker can read it with a single unauthenticated request. The bug is rated 8.6 out of 10 in severity, requires no login and no user interaction, and affects a range of Next.js versions from 13.4.13 through 16.2.4 when self-hosted, it is fixed in 15.5.16 and 16.2.5. To let people reproduce and study the issue safely, the repository includes a Docker Compose lab with five containers: a vulnerable Next.js instance, a patched Next.js instance, two fake AWS metadata services attached to each one to stand in for a real cloud instance, and a mock internal service. A Python proof of concept script runs a set of SSRF test probes against a target and reports which ones succeed, and the README includes raw netcat commands for manually sending the crafted WebSocket upgrade request, since ordinary tools like curl cannot construct the unusual URL shape the exploit needs. Screenshots in the repository show the vulnerable instance leaking IAM credentials, instance metadata, and secrets baked into instance startup scripts, and show the same requests being cleanly rejected once the patched version is running.