Metadata-Service

Next.js WebSocket Upgrade SSRF (Self-Hosted) (CVE-2026-44578)

CVE-2026-44578 is a server-side request forgery (SSRF) vulnerability in self-hosted Next.js WebSocket upgrade handling. A crafted HTTP request with Upgrade: websocket can coerce vulnerable versions into proxying to attacker-chosen internal targets on port 80…