PT-2026-39417 · Vercel · Next.Js

Published 2026-05-09 · Updated 2026-05-13 · CVE-2026-44572

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Next.js versions 12.2.0 through 15.5.15 Next.js versions 16.0.0 through 16.2.4

Description An external client can send an x-nextjs-data header on a request to a path handled by middleware that returns a redirect. This causes the middleware or proxy to treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Since browsers do not follow x-nextjs-redirect, the response becomes an unusable redirect. If the application is deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single request can poison the cached redirect response. This results in a denial of service for that redirect path for subsequent visitors until the cache entry expires or is purged.

Recommendations Update to version 15.5.16. Update to version 16.2.5. Configure the CDN or reverse proxy to vary its cache key on x-nextjs-data for affected responses.

Fix

DoS

Weakness Enumeration

CWE-349

Related Identifiers

CVE-2026-44572

GHSA-3G8H-86W9-WVMQ

Affected Products

Next.Js

References · 9

• https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44572 · Security Note
• https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq · Vendor Advisory
• https://github.com/vercel/next.js/releases/tag/v15.5.16 · Note
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/releases/tag/v16.2.5 · Note
• https://t.me/CVEtracker/53670 · Telegram Post
• https://t.me/brutsecurity/2701 · Telegram Post
• https://t.me/proxy_bar/3371 · Telegram Post