AI description
Automated description summarized from trusted sources.
CVE-2026-44576 is an "Interpretation Conflict" vulnerability affecting the 'next' (Next.js) React framework. This flaw stems from the improper handling of shared cache entries for React Server Component responses within affected versions of the package. An attacker can exploit this vulnerability by manipulating shared cache behavior through crafted requests. This manipulation allows them to cause unintended component payloads to be served to other users.
- Description
- Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- next.js
CVSS 3.1
- Type
- Secondary
- Base score
- 5.4
- Impact score
- 2.7
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
- Severity
- MEDIUM
- security-advisories@github.com
- CWE-436
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "F402B839-26EF-4506-BF6F-038CBE1C908C",
"versionEndExcluding": "15.5.16",
"versionStartIncluding": "14.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A",
"versionEndExcluding": "16.2.5",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]