Full Report
Next.js security advisory (AV26-851)
Analysis Summary
# Vulnerability: Next.js Server-Side Request Forgery and Cache Poisoning
## CVE Details
- **CVE ID:** CVE-2026-38291 (Identified via AV26-851)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-918 (Server-Side Request Forgery), CWE-444 (Inconsistent HTTP Method Interpretation)
## Affected Systems
- **Products:** Next.js Framework
- **Versions:**
- Version 15.5 prior to 15.5.24
- Version 16.3 prior to 16.3.3
- **Configurations:** Applications utilizing the App Router with specific caching headers and middleware configurations are at heightened risk.
## Vulnerability Description
The vulnerability arises from an improper validation of the `Host` header and internal request routing mechanisms within Next.js. An attacker can craft a malicious request that bypasses standard security checks, allowing them to perform Server-Side Request Forgery (SSRF). In specific configurations, this flaw can be chained to achieve Cache Poisoning, leading to the delivery of malicious content to other users by corrupting the server-side cache.
## Exploitation
- **Status:** PoC available (Publicly disclosed in security research circles)
- **Complexity:** Medium
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Potential to access internal services and metadata)
- **Integrity:** High (Cache poisoning allows for content manipulation)
- **Availability:** Low (Possible denial of service via cache exhaustion)
## Remediation
### Patches
- **Next.js 15.x:** Upgrade to version **15.5.24** or later.
- **Next.js 16.x:** Upgrade to version **16.3.3** or later.
### Workarounds
- Implement strict `Host` header validation at the Reverse Proxy (e.g., Nginx, Cloudflare) or Load Balancer level to ensure requests only reach the application with approved hostnames.
- Disable experimental caching features if they are not essential to the production environment.
## Detection
- **Indicators of Compromise:** Unusual traffic patterns originating from the web server to internal-only IP addresses (e.g., 169.254.169.254 or 127.0.0.1).
- **Detection methods and tools:**
- Audit web server logs for requests with mismatched `X-Forwarded-Host` and `Host` headers.
- Use vulnerability scanners configured to detect SSRF patterns in Node.js environments.
## References
- **Vendor Advisory:** hxxps[://]nextjs[.]org/blog/august-2026-security-release
- **Cyber Centre Alert:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/nextjs-security-advisory-av26-851