Vulnerability in Vercel Next.js
CVE-2026-29057
Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. The vulnerability originated in an upstream library vendored by Next.js. It is fixed in Next.js 15.5.13 and 16.1.7 by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path. If upgrading is not immediately possible, block chunked `DELETE`/`OPTIONS` requests on rewritten routes at the edge/proxy, and/or enforce authentication/authorization on backend routes.
Vulnerability class: HTTP Request Smuggling
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.005 (42.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 42.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001
Affected products
- Vercel Next.js — versions >= 16.0.0-beta.0, < 16.1.7, >= 9.5.0, < 15.5.13
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8 (Mitigation, Vendor Advisory)
- github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6 (Patch)
- github.com/vercel/next.js/releases/tag/v15.5.13 (Product, Release Notes)
- github.com/vercel/next.js/releases/tag/v16.1.7 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-29057?
- CVE-2026-29057 is a medium-severity vulnerability in Vercel Next.js, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 6.5/10. Published 2026-03-18.
- How severe is CVE-2026-29057?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2026-29057 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.