Request Smuggling Vulnerability in Next.js Framework from Vercel
CVE-2026-29057
What is CVE-2026-29057?
Next.js, a popular React framework by Vercel, contains a vulnerability that arises during the rewriting of proxy traffic to external backends. In specific versions, specially crafted DELETE or OPTIONS requests utilizing Transfer-Encoding: chunked can cause a mismatch between the proxy and backend requests. This inconsistency allows an attacker to potentially send a second request to unintended internal endpoints, thus breaching security assumptions about the configurated routing mechanisms. The issue has been addressed in Next.js versions 15.5.13 and 16.1.7 by modifying dependency behaviors to correctly manage content-length and transfer-encoding handling. For immediate risk mitigation, users are advised to block chunked requests on rewritten routes and enforce stringent authentication or authorization controls.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
next.js >= 16.0.0-beta.0, < 16.1.7 < 16.0.0-beta.0, 16.1.7
next.js >= 9.5.0, < 15.5.13 < 9.5.0, 15.5.13