CVE-2026-44578: Unauthenticated SSRF in Next.js 14.2.35 – Will Never Be Patched

🔴 CVSS Score: 8.6 (High) · Affects: Next.js 13.4.13 – 15.5.15 and 16.0.0 – 16.2.4 on self-hosted next start
· EOL: Next.js 13.x (December 2024), Next.js 14.x (October 2025) · Patch available: Never for EOL branches

CVE-2026-44578 Nextjs 14.2.35 is an unauthenticated SSRF risk with no vendor patch path for EOL 13.x and 14.x branches. If your team runs self-hosted Next.js on 13.x or 14.x, you are exposed to CVE-2026-44578 with no vendor patch path. Attackers can send unauthenticated WebSocket upgrade requests and force your Node.js process to proxy internal HTTP GET targets, including 169.254.169.254. You need compensating controls now and a supported-version migration path immediately.

Use these dofollow references for validation and response playbooks: Next.js Support Policy, NVD CVE-2026-44578, and Next.js lifecycle status. For related coverage on your own site, link readers to CVE Watch, Migration Guides, and Deprecation Watch.

CVE-2026-44578 Nextjs 14.2.35 Vulnerability Summary

What the Vulnerability Does

The CVE-2026-44578 Nextjs 14.2.35 SSRF sits in packages/next/src/server/lib/router-server.ts in the WebSocket upgrade handling path. The standard HTTP flow checks both request completion state and protocol, but the upgrade path checks protocol only. That mismatch lets an unauthenticated actor craft Connection: Upgrade and Upgrade: websocket traffic that triggers internal proxying behavior.

In production, this can expose internal admin routes, internal microservices, Docker bridge targets, and cloud metadata endpoints. In Kubernetes, the same flaw can target https://kubernetes.default.svc or east-west service ports if your network controls are weak. If your node can still query IMDS without IMDSv2 enforcement, attackers can pull temporary IAM credentials and pivot.

The same disclosure window also includes bypass and availability risks you cannot ignore. App Router prefetch and .rsc transport variants can bypass middleware auth checks (CVE-2026-44575), and Turbopack-specific execution paths stayed bypassable after an initial fix (CVE-2026-45109). RSC deserialization flaws can trigger CPU and memory exhaustion (CVE-2026-23870), while CSP nonce handling and cache-token behavior introduce stored XSS and cache poisoning paths (CVE-2026-44581, CVE-2026-44582).

Are You Affected?

# Identify exact framework and environment details
npx next info

# Confirm deployed Next.js version range
npm ls next

# Check RSC package exposure tied to DoS disclosures
npm ls react-server-dom-webpack
npm ls react-server-dom-turbopack

# Find middleware-centric auth controls (high bypass risk)
find . -name "middleware.ts" -o -name "middleware.js"

# Find CSP nonce and header-driven CSP generation points
grep -rn "nonce" src/
grep -rn "Content-Security-Policy" src/

If you run self-hosted next start in the affected ranges, you are in scope for CVE-2026-44578. If your auth model depends primarily on middleware.ts, you are also in scope for CVE-2026-44575 and CVE-2026-45109 bypass behavior. Treat CVE-2026-44578 Nextjs 14.2.35 as an immediate production hardening trigger.

Why There Is No Patch Coming

Your patch path depends on support lifecycle, not intent. The raw draft states Next.js 13.x is EOL as of December 2024 and 14.x is EOL as of October 2025, and those branches do not receive official security backports. Vercel-managed hosting avoids this specific SSRF vector, but that does not remove bypass and DoS exposure for other CVEs in the same period.

If you are on 13.x or 14.x, your operational choice is clear: harden aggressively now, then migrate. Treat this as both a security incident and a compliance issue under SOC 2 CC6.1/CC7.1, PCI-DSS 4.0 section 6.3.3, and ISO 27001:2022 Annex A 8.8, as described in the raw draft.

Immediate Mitigations

Option 1 — Upgrade to Supported Version (Recommended)

Use patched supported branches now:

• Upgrade to 15.5.16 or 16.2.5 for baseline May 2026 fixes, including SSRF.
• Upgrade to 15.5.18 or 16.2.6 to cover the Turbopack bypass fix gap.
• If you cannot move off 13.x/14.x in one change window, isolate and harden while you stage migration.

Option 2 — Network-Level Mitigation

Drop unnecessary upgrade traffic at ingress and constrain egress from application pods.

# NGINX mitigation for CVE-2026-44578
server {
    listen 80;
    server_name application.internal;

    location / {
        proxy_pass http://localhost:3000;

        # Strip upgrade headers if your app does not require WebSockets
        proxy_set_header Upgrade "";
        proxy_set_header Connection "";

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

# Kubernetes NetworkPolicy for Next.js egress lockdown
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-nextjs-egress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: nextjs-frontend
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
  - to:
    - namespaceSelector:
        matchLabels:
          name: backend-services

Enforce IMDSv2 on AWS nodes. The draft states this SSRF path is GET-only, which blocks the PUT-token requirement for IMDSv2.

Option 3 — Detection

Detect execution and bypass attempts at multiple layers:

• Monitor for Upgrade: websocket on routes not designed for WebSockets.
• Alert on outbound Node.js connections to 169.254.169.254 and unexpected RFC1918/internal ranges.
• Flag the log fingerprint Failed to proxy http:/ for SSRF path execution.
• Alert on 200 OK to protected .rsc/prefetch route variants without valid session context.
• Monitor CDN analytics for concentrated _rsc key collisions and response-size variance on identical keys.

Upgrade Path

1. Inventory every Next.js deployment and classify by hosting model: Vercel-managed, self-hosted VM, Docker, Kubernetes, edge runtime.
2. Prioritize internet-facing self-hosted services and apply ingress + egress mitigations within 24 hours.
3. Enforce IMDSv2 and block metadata endpoint access from application workloads.
4. Upgrade branches to 15.5.18 or 16.2.6 and validate all environment-specific build paths, including Turbopack.
5. Move authorization checks from edge-only middleware.ts into route handlers and data-access boundaries for defense in depth.
6. Invalidate CDN cache immediately if you generate dynamic CSP nonces from request headers.
7. Add SIEM/APM detections for missing middleware spans, .rsc anomalies, and suspicious upgrade traffic.

If you cannot upgrade today, implement two controls now: strip unneeded WebSocket upgrade headers at ingress and lock outbound egress from Next.js workloads. Then schedule the supported-version migration as your next production change for CVE-2026-44578 Nextjs 14.2.35.