#self-hosting

Analysis · May 14, 2026 · Colten Anderson

Vercel shipped the framework. You're shipping the patch

CVE-2026-44578 is a CVSS 8.6 SSRF in self-hosted Next.js. The fix for 13.x and 14.x users is a major-version migration, filed against your product team as a Dependabot chore.