CVE-2026-44581 Details
Description
Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5.
A stored cross-site scripting vulnerability has been identified in Next.js App Router applications that use Content Security Policy (CSP) nonces, specifically in versions 13.4.0 prior to 15.5.16 and 16.0.0 prior to 16.2.5. When deployed behind shared caches, these applications can be exploited by reflecting malformed nonce values from request headers into the rendered HTML. This allows an attacker to poison cached responses, leading to script execution for subsequent visitors.
Users can upgrade to Next.js versions 15.5.16 or 16.2.5, where this vulnerability has been fixed. If an immediate upgrade is not possible, it is recommended to strip inbound Content-Security-Policy request headers from untrusted traffic.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 13.4.0, < 15.5.16 >= 16.0.0, < 16.2.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |