Cache Poisoning Vulnerability in Next.js Framework by Vercel
CVE-2026-44576
5.4MEDIUM
What is CVE-2026-44576?
Next.js, a robust React framework for building full-stack web applications, is susceptible to a cache poisoning vulnerability. This issue arises in applications utilizing React Server Components, specifically in versions from 14.2.0 to prior to 15.5.16 and 16.2.5. When shared caches are inadequately partitioned, an attacker may exploit this weakness to serve compromised RSC responses from the original URL, leading to the poisoning of shared cache entries. Consequently, subsequent visitors may receive unintended component payloads instead of the intended HTML. This vulnerability has been addressed in versions 15.5.16 and 16.2.5.
Affected Version(s)
next.js >= 14.2.0, < 15.5.16 < 14.2.0, 15.5.16
next.js >= 16.0.0, < 16.2.5 < 16.0.0, 16.2.5