CVE-2026-29057: 
ASP.NET Core vulnerability analysis and mitigation

CVE-2026-29057 is an HTTP request smuggling vulnerability in Next.js affecting its rewrite proxy mechanism. When Next.js rewrites proxy traffic to an external backend, a crafted DELETE or OPTIONS request using Transfer-Encoding: chunked can trigger a request boundary disagreement between the proxy and backend, enabling request smuggling through rewritten routes. The vulnerability affects Next.js versions 9.5.0 through 15.5.12 and 16.0.0 through 16.1.6; applications hosted on CDN-level rewrite providers such as Vercel are not impacted. It was published on March 16, 2026, with a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Vercel Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling), originating in the vendored http-proxy@1.18.1 library used by Next.js. The vulnerable deleteLength function in web-incoming.js unconditionally added content-length: 0 and removed the transfer-encoding header for DELETE/OPTIONS requests whenever content-length was absent — without checking whether transfer-encoding was also present. This caused the proxy to strip the Transfer-Encoding: chunked header while forwarding the request body as-is, creating a disagreement between how the proxy and the backend parsed request boundaries. An unauthenticated attacker can exploit this by sending a single TCP connection containing a crafted chunked DELETE or OPTIONS request to a rewritten route, with a smuggled second request embedded in the body, which the backend then interprets as a separate, independent request (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to smuggle a second HTTP request to unintended backend routes — such as internal or administrative endpoints — that are not directly reachable via the configured rewrite rules. This can result in unauthorized access to sensitive functionality, data disclosure (low confidentiality impact), and unauthorized modification of backend state (low integrity impact). Availability is not directly impacted, but the ability to reach internal endpoints could facilitate further lateral movement or privilege escalation within the backend infrastructure (GitHub Advisory, Feedly).

No public proof-of-concept exploit was confirmed at the time of initial disclosure, though a community PoC repository (github.com/Nayekah/Next.js-Proof-of-Concept) appeared in Feedly tracking data in late April 2026. There is no evidence of active in-the-wild exploitation or threat actor attribution as of the latest available data. The EPSS score is approximately 0.08% (9th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Next.js applications (versions 9.5.0–15.5.12 or 16.0.0–16.1.6) that use the rewrites configuration to proxy traffic to an external backend and are self-hosted (not on Vercel CDN). Tools like Shodan, Censys, or HTTP fingerprinting can help identify Next.js deployments.
2. Identify rewritten routes: Probe the target application to discover URL paths that trigger rewrites (e.g., /api/proxy/:path* or similar patterns defined in next.config.js).
3. Craft the smuggling payload: Construct a raw TCP payload containing a DELETE or OPTIONS request to a rewritten route with Transfer-Encoding: chunked and a Connection: Transfer-Encoding, upgrade header. Embed a second smuggled request (e.g., GET /secret HTTP/1.1) as the chunked body:

DELETE /rewrites/poc HTTP/1.1\r\n
Host: target.example.com\r\n
Transfer-Encoding: chunked\r\n
Connection: Transfer-Encoding, upgrade\r\n
\r\n
<hex-chunk-size>\r\n
GET /secret HTTP/1.1\r\nHost: target.example.com\r\n\r\n
\r\n
0\r\n
\r\n

4. Send via raw TCP: Use a raw socket (e.g., Python's socket module or netcat) to send the payload directly, bypassing HTTP client libraries that may normalize headers.
5. Observe backend response: The Next.js proxy strips Transfer-Encoding before forwarding, causing the backend to interpret the embedded request as a separate HTTP request, potentially reaching internal routes (e.g., /secret, /admin) that are not exposed via the rewrite configuration (GitHub Commit, GitHub Advisory).

• Network: Unexpected DELETE or OPTIONS requests to rewritten proxy routes containing Transfer-Encoding: chunked headers; raw TCP connections to the Next.js server that do not follow standard HTTP client behavior (e.g., no User-Agent, unusual connection timing).
• Logs: Backend access logs showing requests to internal or admin endpoints (e.g., /secret, /admin, /internal/*) that were not initiated by legitimate clients; requests arriving at the backend with no corresponding entry in the Next.js access log for the same path.
• Application Behavior: Unexpected HTTP responses from backend routes that should not be publicly accessible; anomalous sequences of backend requests where a single client connection results in multiple distinct backend requests to different paths.

Upgrade to Next.js 15.5.13 or 16.1.7, which patch the vulnerability by updating the vendored http-proxy dependency so that content-length: 0 is added only when both content-length and transfer-encoding headers are absent, and transfer-encoding is no longer removed in that code path (GitHub Release v15.5.13, Vercel Advisory). If immediate upgrade is not possible, apply the following interim mitigations:

• Block chunked DELETE and OPTIONS requests on rewritten routes at the edge/proxy/WAF layer.
• Enforce strict authentication and authorization on all backend routes, particularly internal and administrative endpoints, to limit the impact of any smuggled requests.
• Applications hosted on Vercel's CDN (which handles rewrites at the CDN level) are not affected and require no action.

Red Hat tracked the vulnerability via Bugzilla (Bug 2448515) and assessed it as medium severity, with multiple product teams listed as affected (Red Hat Bugzilla). IBM issued a security bulletin noting that IBM Guardium Data Security Center is affected by this vulnerability (IBM Advisory). HeroDevs published a blog post covering CVE-2026-29057 alongside related Next.js vulnerabilities, noting its relevance to end-of-life Next.js versions. Community reaction on LinkedIn and security aggregators was moderate, with Qualys adding detection coverage in their March 2026 application security detections release.