Next.js: Server-side request forgery in applications using WebSocket upgrades
CVSS score
8.6
EPSS probability
%1.9
Risk score
0.2
Published
5 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
este laboratorio puede estar bien o mal esta el pruebas pero debe funcionar preguntale a la IA hahah
CVE-2026-44578: Next.js WebSocket Upgrade SSRF — pre-auth credential theft via localhost:80. Lab + exploit + audit.
Nuclei templates for detecting CVE-2026-44578 (Next.js WebSocket Upgrade SSRF) with multi-cloud metadata validation, Next.js fingerprinting, and real-world scanning workflows. Includes references to the original NextSSRF research and exploit tooling.
NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF
Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572)
Nuclei: Next.js WebSocket Upgrade Handler - SSRF
Similar Vulnerabilities
Deserialization of untrusted data in Meta React Server Dom Webpack
Deserialization of untrusted data in Facebook React
Vulnerability in Facebook React
Deserialization of untrusted data in Facebook React
Command injection in Vercel AI
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-44578"