CVE-2026-44578

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Pre-authentication Server-Side Request Forgery in Next.js self-hosted deployments. A single crafted HTTP request extracts AWS credentials, secrets, and internal service data from localhost:80...