{"id":"GHSA-ggv3-7p47-pfv8","summary":"Next.js: HTTP request smuggling in rewrites","details":"## Summary\nWhen Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.\n\n## Impact\nAn attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. \n\n## Patches\nThe vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.\n\n## Workarounds\nIf upgrade is not immediately possible:\n- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.\n- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).","aliases":["CVE-2026-29057"],"modified":"2026-09-10T03:50:39.201962373Z","published":"2026-03-17T16:17:15Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-03-17T16:17:15Z","nvd_published_at":"2026-03-18T01:16:05Z","cwe_ids":["CWE-444"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29057"},{"type":"WEB","url":"https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6"},{"type":"PACKAGE","url":"https://github.com/vercel/next.js"},{"type":"WEB","url":"https://github.com/vercel/next.js/releases/tag/v15.5.13"},{"type":"WEB","url":"https://github.com/vercel/next.js/releases/tag/v16.1.7"}],"affected":[{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.1.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-ggv3-7p47-pfv8/GHSA-ggv3-7p47-pfv8.json"}},{"package":{"name":"next","ecosystem":"npm","purl":"pkg:npm/next"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.5.0"},{"fixed":"15.5.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-ggv3-7p47-pfv8/GHSA-ggv3-7p47-pfv8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}