CVE-2026-29057

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

Workarounds

If upgrade is not immediately possible:

• Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
• Enforce authentication/authorization on backend routes per our security guidance.

An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.

Kodem intelligence

The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.

1. What is CVE-2026-29057? CVE-2026-29057 is a medium-severity security vulnerability in next (npm), affecting versions >= 16.0.0-beta.0, < 16.1.7. It is fixed in 16.1.7, 15.5.13.
2. Which versions of next are affected by CVE-2026-29057? next (npm) versions >= 16.0.0-beta.0, < 16.1.7 is affected.
3. Is there a fix for CVE-2026-29057? Yes. CVE-2026-29057 is fixed in 16.1.7, 15.5.13. Upgrade to this version or later.
4. Is CVE-2026-29057 exploitable, and should I be worried? Whether CVE-2026-29057 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-29057 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-29057?
   • Upgrade next to 16.1.7 or later
   • Upgrade next to 15.5.13 or later