#碎碎念 #前端 #安全 #新动态看乐了，还好我已经远离 Next.js 了CVE-2026-44578 CVE-2026-44578 ⚠️ Next.js – WebSocket Upgrade SSRF (CVSS 8.6) A server-side request forgery vulnerability in Next.js allows unauthenticated attackers to force self-hosted instances to make internal HTTP requests via the WebSocket upgrade handler. By sending a crafted absolute-form HTTP request with Upgrade: websocket headers, attackers can access internal services, cloud metadata endpoints, admin panels, and internal APIs reachable from the Next.js server on port 80. Successful exploitation may expose cloud credentials, API keys, secrets, and configuration data. Affected: Next.js 13.4.13+, 14.x, 15.x <15.5.16, 16.0.0–16.2.4 Mitigation: Upgrade immediately to 15.5.16 or 16.2.5. Modat Magnify Query: technology="Next.js" The platform:

Thu, 14 May 2026 14:24:37 GMT

#碎碎念 #前端 #安全 #新动态
看乐了，还好我已经远离 Next.js 了

CVE-2026-44578

CVE-2026-44578
⚠️ Next.js – WebSocket Upgrade SSRF (CVSS 8.6)

A server-side request forgery vulnerability in Next.js allows unauthenticated attackers to force self-hosted instances to make internal HTTP requests via the WebSocket upgrade handler.
By sending a crafted absolute-form HTTP request with Upgrade: websocket headers, attackers can access internal services, cloud metadata endpoints, admin panels, and internal APIs reachable from the Next.js server on port 80. Successful exploitation may expose cloud credentials, API keys, secrets, and configuration data.

Affected: Next.js 13.4.13+, 14.x, 15.x <15.5.16, 16.0.0–16.2.4

Mitigation: Upgrade immediately to 15.5.16 or 16.2.5.

Modat Magnify Query:
technology="Next.js"

The platform:
https://magnify.modat.io/

#threatintel #vulnerability #CVE202644578 #Nextjs #SSRF #WebSocket #CloudSecurity #infosec #Critical #ModatMagnify

最近 CVE 好热闹啊

ModatMagnify | 笨蛋三月七的日常