Priority reviewHigh

CVE-2026-44578

vercel next.js, Streams for Apache Kafka 2.9.4, Red Hat Trusted Artifact Signer 1.4

Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.

CVSS: 8.6
EPSS: 38.9%
CISA KEV: Not listed
Published: 2026.05.14

PRIORITY ASSESSMENT

Priority review

FIRST EPSS indicates an elevated probability of exploitation.

Known exploitationNot established by KEV

Exploit probability38.9%

Technical severityCVSS 8.6

Vulnerability overview

Affected product and versions

Product: vercel next.js, Streams for Apache Kafka 2.9.4, Red Hat Trusted Artifact Signer 1.4
Affected versions: >= >= 16.0.0, < 16.2.5, >= >= 13.4.13, < 15.5.16, >= 13.4.13 < 15.5.16, >= 16.0.0 < 16.2.5
Fixed versions: 15.5.16, 16.2.5

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that vercel next.js, Streams for Apache Kafka 2.9.4, Red Hat Trusted Artifact Signer 1.4 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE: CWE-918