CVE-2026-29057: Next.js HTTP Request Smuggling Vulnerability in Rewrites
Summary
CVE-2026-29057: Next.js: HTTP request smuggling in rewrites. Affects next across 2 version ranges.
>= 9.5.0, < 15.5.13
>= 16.0.0-beta.0, < 16.1.7
Fixed in 15.5.13 or 16.1.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered applications with ease. It provides features such as automatic code splitting, server-side rendering, and static site generation. However, like any software, it can be vulnerable to security issues. This specific vulnerability allows for HTTP request smuggling through rewritten routes, which can lead to unauthorized access to backend services.
Vulnerability Detail
The vulnerability arises when Next.js rewrites proxy traffic to an external backend. A malicious actor can craft a DELETE or OPTIONS request using Transfer-Encoding: chunked, leading to a request boundary disagreement between the proxy and the backend. This discrepancy can allow an attacker to smuggle a second request to unintended backend routes, potentially accessing sensitive internal endpoints. The issue is rooted in an upstream library used by Next.js, which mishandles the content-length and transfer-encoding headers.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.5.0, < 15.5.1315.5.13npm install next@15.5.13 -
>= 16.0.0-beta.0, < 16.1.716.1.7npm install next@16.1.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot upgrade immediately, consider implementing the following workarounds: Block chunked DELETE and OPTIONS requests on rewritten routes at your edge or proxy. Additionally, enforce strict authentication and authorization on backend routes as per the security guidance provided by Next.js.
Conclusion
In summary, CVE-2026-29057 is a moderate severity vulnerability in Next.js that allows for HTTP request smuggling through rewritten routes. It is crucial to update to the patched versions or implement workarounds to protect your application from potential attacks.
See every vulnerability recorded for next →
FAQ
HTTP request smuggling is a technique used by attackers to send malicious requests to a server by exploiting discrepancies in how different components of a web application interpret HTTP requests.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
An attacker could gain unauthorized access to sensitive backend routes, potentially compromising the security of internal services and data.
No, the vulnerability affects specific versions of Next.js. Ensure you are using the patched versions to mitigate the risk.
The CVSS score of this vulnerability is 6.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
