CVE-2026-44578

🚨 CVE-2026-44578 — Next.js SSRF Vulnerability 📌 Overview CVE-2026-44578 is a high-severity Server-Side Request Forgery SSRF vulnerability affecting self-hosted Next.js applications. Attackers can exploit crafted WebSocket Upgrade Requests to force the server into making outbound requests to...

cve-2026-69243-poc-aiohttp-smuggling

CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request smuggling via rejected WebSocket upgrade in aiohttp Or build the Rust version zero dependencies, std only: git clone https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling cd cve-2026-69243-poc-aiohttp-smuggling/poc cargo build...

verify-ghsa-c4j6-fc7j-m34r

verify-ghsa-c4j6-fc7j-m34r In-band verifier for GHSA-c4j6-fc7j-m34r / CVE-2026-44578 — Server-Side Request Forgery in Next.js via WebSocket upgrade requests. ⚠️ For authorized security testing only. You are responsible for ensuring you have permission to test every target you pass to this script...

CVE-2026-44578-PoC

CVE-2026-44578 - Next.js WebSocket SSRF PoC Vulnerability: Server-Side Request Forgery in Next.js WebSocket upgrade handler 13.4.13 → 15.5.15, 16.0.0 → 16.1.6 Usage Detect vulnerability python3 poc.py target.com:3000 --detect Tunnel to internal Redis python3 poc.py target.com:3000 --internal...

CVE-2026-44578

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Pre-authentication Server-Side Request Forgery in Next.js self-hosted deployments. A single crafted HTTP request extracts AWS credentials, secrets, and internal service data from localhost:80. Field| Value ---|--- CVE| CVE-2026-44578 GHSA|...

CVE-2020-7693

CVE-2020-7693 Poc Note: I Confirm Payload for CVE-2020-7693 can running in Bug Bounty Program Description: Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20. Single Request Crashes Serve...

cve-2018-1002105

CVE-2018-1002105 Test utility that checks a cluster for the high severity kubernetes CVE published here. A stakeholder-level writeup of the CVE-2018-1002105 may be found at https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/ Warning Running this test through layer ...

CVE-2026-44578-next-js-ssrf

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Lab Self-contained lab to reproduce the CVE-2026-44578 vulnerability CWE-918, SSRF in self-hosted Next.js applications that use the built-in Node.js server. Field| Value ---|--- CVE| CVE-2026-44578 GHSA| GHSA-c4j6-fc7j-m34r CVSS 3.1| 8.6 HIGH...

cve-2018-1002105

This was modified from https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/. All credit goes to the kind folks at Gravitational. The original PoC code was modified to go a bit beyond checking for vulnerability and to actually run a command inside the first container...

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were...

Incorrect Authorization

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

GHSA-CXF3-9H37-7RR8 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were...

Incorrect Authorization

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

PT-2026-129134

Name of the Vulnerable Software and Affected Versions Echo versions 4.0.0 through 4.16.0 Echo versions 5.0.0 through 5.4.0 Description The Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying if the configured upstream accepted the upgrade. If the upstrea...

Origin Validation Error

Overview org.webjars.npm:webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Origin Validation Error via the WebSocket upgrade handler in lib/Server.js when a...

Eclipse ioFog encryption issue vulnerability

Versions 3.8.0 through 3.9.1 of Eclipse ioFog contain an encryption-related vulnerability. This vulnerability arises from the operator WebSocket upgrade for exec and log routes failing to validate bearer JWTs; additionally, groups or roles defined in the decoded payload are used as RBAC subjects...

CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets...

CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets...

CVE-2026-57169

The Docker management application Dockhand is vulnerable to unauthenticated command execution in versions prior to 1.0.34 . The /api/containers/exec endpoint fails to enforce authentication during a WebSocket upgrade request. An unauthenticated attacker with network reach and knowledge of a targe...

nextssrf

╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...