CVE-2026-44582 Details
Description
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
A cache poisoning vulnerability has been identified in Next.js versions 13.4.6 prior to 15.5.16 and 16.0.0 prior to 16.2.5. This issue affects deployments that use shared caches with inadequate response partitioning, allowing an attacker to manipulate cache entries. As a result, users may receive incorrect response variants for specific URLs. The vulnerability arises from collisions in the '_rsc' cache-busting value, which can be exploited to poison cache responses.
To address this vulnerability, users should upgrade to Next.js versions 15.5.16 or 16.2.5. If an immediate upgrade is not possible, ensure that intermediary caches properly respect the 'Vary' header for RSC-related request headers, or disable shared caching for affected RSC responses until a patched version can be deployed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-328 | Use of Weak Hash | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 13.4.6, < 15.5.16 >= 16.0.0, < 16.2.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |