Impact
Self-hosted applications using the built-in Next.js Node.js server may proxy requests to unintended internal or external destinations when handling crafted WebSocket upgrade requests under the advisory conditions. [S1][S2] Practical risk depends on the deployed server mode, routing configuration, origin exposure, outbound network policy, and destination reachability. [S1] Vercel-hosted deployments are not affected. [S1]
Root cause
The vulnerable upgrade path could proxy a request before the routing decision was confirmed as safe. [S1] The patched releases add safety checks so this proxying only occurs for routing that explicitly permits a safe external rewrite. [S1]
Affected versions
The reviewed advisory lists these affected npm release ranges: [S1][S2][S3]
next >=13.4.13 <15.5.16[S1][S2][S3]next >=16.0.0 <16.2.5[S1][S2][S3]
Patched releases:
15.5.16[S1][S5]16.2.5[S1][S6]
Remediation
Upgrade the active release line:
- Next.js
15.5.16or newer on the 13.x-15.x line [S1][S5] - Next.js
16.2.5or newer on the 16.x line [S1][S6]
If an immediate upgrade is not possible, do not expose the origin to untrusted networks, block upgrades when they are not required, and restrict origin egress and access to internal destinations. [S1]
Covered by FixVibe
FixVibe GitHub authorized repository scans report affected Next.js dependency evidence as a version-based advisory. A finding identifies patch-triage evidence; it does not prove that the application is self-hosted, uses the affected server path, or is exploitable. FixVibe does not send upgrade requests, callbacks, requests to internal hosts, cloud-metadata requests, or exploit payloads. Vercel-hosted deployments are outside the affected condition in the upstream advisory. [S1]