Vulnerability Description
Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vercel | Next.Js | >= 13.4.0, < 15.5.16 |
Related Weaknesses (CWE)
References
- https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4qMitigationVendor Advisory
FAQ
What is CVE-2026-44581?
CVE-2026-44581 is a vulnerability with a CVSS score of 4.7 (MEDIUM). Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site ...
How severe is CVE-2026-44581?
CVE-2026-44581 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44581?
Check the references section above for vendor advisories and patch information. Affected products include: Vercel Next.Js.