GHSA-ggv3-7p47-pfv8
NoneCVSS
—
EPSS
—
Published
Mar 17, 2026
CISA due date
—
The record
Next.js: HTTP request smuggling in rewrites
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | next | 16.0.0-beta.0 | 16.1.7 |
| npm | next | 9.5.0 | 15.5.13 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r17 |
| Chainguard | keep-ui | 0 | 0.51.0-r1 |
| Chainguard | keep-ui-fips | 0 | 0.51.0-r1 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r14 |
| Chainguard | langfuse-3 | 0 | 3.162.0-r1 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r17 |
| Chainguard | langfuse-fips-3 | 0 | 3.162.0-r0 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r17 |
| Wolfi | langfuse-3 | 0 | 3.162.0-r1 |
Related vulnerabilities
- CVE-2026-29057 Next.js is a React framework for building full-stack web applications. Same vulnerability
- CVE-2026-44582 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-45109 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44581 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44580 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44579 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44578 Next.js is a React framework for building full-stack web applications. Also affects next
- CVE-2026-44576 Next.js is a React framework for building full-stack web applications. Also affects next