Next.js: HTTP request smuggling in rewrites

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-29057 · CVE overview and exploitation status

EUVD-2026-12704

GHSA-ggv3-7p47-pfv8

cve-program · CVE-2026-29057

• https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8
• https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
• https://github.com/vercel/next.js/releases/tag/v15.5.13
• https://github.com/vercel/next.js/releases/tag/v16.1.7

euvd · EUVD-2026-12704

• https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8
• https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
• https://github.com/vercel/next.js/releases/tag/v15.5.13
• https://github.com/vercel/next.js/releases/tag/v16.1.7

nvd · CVE-2026-29057

• https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
• https://github.com/vercel/next.js/releases/tag/v15.5.13
• https://github.com/vercel/next.js/releases/tag/v16.1.7
• https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8

osv · GHSA-ggv3-7p47-pfv8

• https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8
• https://nvd.nist.gov/vuln/detail/CVE-2026-29057
• https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
• https://github.com/vercel/next.js
• https://github.com/vercel/next.js/releases/tag/v15.5.13
• https://github.com/vercel/next.js/releases/tag/v16.1.7

• Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request usin… · Advisory content revised · 15 Nov 2026