AIKIDO-2026-10758
next is vulnerable to Server-Side Request Forgery (SSRF)
86
High Risk
This Affects:
nextTL;DR
WebSocket upgrade proxying in self-hosted deployments can be abused to reach arbitrary destinations. Crafted upgrade requests can trigger outbound proxy behavior toward internal or external targets. This creates server-side request forgery risk and possible exposure of internal services. The fix applies existing external rewrite safety checks to upgrade handling.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
next is vulnerable to Server-Side Request Forgery (SSRF) in versions 13.4.13 - 15.5.15 and 16.0.0 - 16.2.4.
How to fix this
Upgrade the next library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant