CVE-2026-44581

Published May 13, 2026

Last updated a month ago

Next.js

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-44581 describes a cross-site scripting (XSS) vulnerability affecting Next.js App Router applications that employ Content Security Policy (CSP) nonces. This flaw is particularly noteworthy as it exploits a mechanism specifically designed to prevent XSS attacks, effectively turning CSP nonces against their intended purpose. The vulnerability impacts React's server component packages, including `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`, for which patched versions have been released.

Description: Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5.
Source: security-advisories@github.com
NVD status: Analyzed
Products: next.js

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.7
Impact score: 2.7
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

security-advisories@github.com: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "A9F82F11-CD68-440C-AFAE-98AF7B8DB69F",
            "versionEndExcluding": "15.5.16",
            "versionStartIncluding": "13.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A",
            "versionEndExcluding": "16.2.5",
            "versionStartIncluding": "16.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.