UpHeron
All vulnerabilities

npm

CVE-2026-29057

Next.js: HTTP request smuggling in rewrites

Severity
Medium
Published
17 Mar 2026
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.13, 16.1.7
Also known as
GHSA-ggv3-7p47-pfv8
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 9.5.0 before 15.5.13
  • From 16.0.0-beta.0 before 16.1.7

References