CVE-2026-29057

Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. The vulnerability originated in an upstream library vendored by Next.js. It is fixed in Next.js 15.5.13 and 16.1.7 by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path. If upgrading is not immediately possible, block chunked `DELETE`/`OPTIONS` requests on rewritten routes at the edge/proxy, and/or enforce authentication/authorization on backend routes.

• CWE-444

• https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6Patch
• https://github.com/vercel/next.js/releases/tag/v15.5.13Product, Release Notes
• https://github.com/vercel/next.js/releases/tag/v16.1.7Product, Release Notes
• https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8Mitigation, Vendor Advisory

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29051melange allows users to build apk packages using declarative…3.3
• CVE-2026-29052The Calendar module for HumHub enables users to create one-t…6.1
• CVE-2026-29053Ghost is a Node.js content management system. From version 0…9.8
• CVE-2026-29054Traefik is an HTTP reverse proxy and load balancer. From ver…7.5
• CVE-2026-29055Tandoor Recipes is an application for managing recipes, plan…5.3
• CVE-2026-29056Kanboard is project management software focused on Kanban me…8.8
• CVE-2026-29058AVideo is a video-sharing Platform software. Prior to versio…9.8
• CVE-2026-29059Windmill is an open-source developer platform for internal c…7.5
• CVE-2026-2906A security flaw has been discovered in Tenda HG9 300001138. …8.8
• CVE-2026-29060Gokapi is a self-hosted file sharing server with automatic e…5
• CVE-2026-29061Gokapi is a self-hosted file sharing server with automatic e…5.4
• CVE-2026-29062jackson-core contains core low-level incremental ("streaming…7.5