Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44580Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

Medium 6.1

In plain English

A medium-severity cross-site scripting in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	next	15.5.16	GHSA-gx5p-jg67-6x7h
npm	next	16.2.5	GHSA-gx5p-jg67-6x7h

Affected products (as reported)

Vendor	Product	Versions
vercel	next.js	>= 13.0.0, < 15.5.16>= 16.0.0, < 16.2.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h x_refsource_CONFIRM