CVE-2026-44576 Details
Description
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
A cache poisoning vulnerability has been identified in Next.js versions 14.2.0 prior to 15.5.16 and 16.0.0 prior to 16.2.5, specifically in applications using React Server Components. The issue arises when shared caches fail to properly partition response variants, allowing an attacker to manipulate cache entries. This manipulation can result in subsequent users receiving component payloads instead of the expected HTML. The vulnerability is rooted in inconsistent validation and interpretation of RSC request headers, which can lead to unintended cache behavior.
Users can upgrade to Next.js versions 15.5.16 or 16.2.5 to address this vulnerability. If an immediate upgrade is not possible, it is recommended to ensure that the CDN or reverse proxy respects the relevant RSC request headers and the 'Vary' header, or to disable shared caching for affected App Router and RSC responses.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 14.2.0, < 15.5.16 >= 16.0.0, < 16.2.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |