Vulnerability · Published May 13, 2026 · Assigned by GitHub_M
CVE-2026-44576Next.js: Cache poisoning in React Server Component responses
Medium 5.4
In plain English
A medium-severity security flaw in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | next | 15.5.16 | GHSA-wfc6-r584-vfw7 |
| npm | next | 16.2.5 | GHSA-wfc6-r584-vfw7 |
Affected products (as reported)
Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
References
- https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7 x_refsource_CONFIRM