What is nextssrf?

NextSSRF is a Python command line tool built to scan for and demonstrate a specific security flaw, CVE-2026-44578, found in Next.js. The bug affects self hosted Next.js deployments running version 13.4.13 through 15.5.15, and separately 16.0.0 through 16.2.4. It lets an attacker send a specially formed HTTP request that tricks the server's WebSocket upgrade handler into forwarding traffic to an address the attacker chooses, a technique known as server side request forgery, or SSRF. In practice this can be used to reach internal services that should never be exposed to the outside world, such as cloud metadata endpoints that hold temporary credentials.\n\nThe tool has no external dependencies beyond Python 3.10 or newer, since it only uses the standard library. It can scan a single target, focus on a specific cloud provider such as AWS or Azure, or run across large lists of hosts piped in from other reconnaissance tools. Once a vulnerable target is confirmed, an interactive shell lets the user detect the cloud provider automatically and, where possible, pull out temporary IAM credentials to show the impact of the flaw.\n\nThe README documents clear limits: only GET requests work, only port 80 is reachable, and common defenses like AWS IMDSv2 or a reverse proxy in front of the application block the attack outright. It also includes a section aimed at defenders, showing what exploitation attempts look like in server logs and how to block them with a simple Nginx rule.\n\nThe project states plainly that it is meant only for authorized security testing and bug bounty work carried out with permission. The author, who describes themselves as an active bug bounty researcher, is clear that misuse of the tool is the user's own responsibility.