PT-2026-39418 · Vercel · Next.Js

Timneutkens · Published 2026-05-09 · Updated 2026-05-13 · CVE-2026-44576

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Next.js versions 14.2.0 through 15.5.15 Next.js versions 16.0.0 through 16.2.4

Description Applications using React Server Components (RSC) are susceptible to cache poisoning when shared caches fail to correctly partition response variants. An attacker can manipulate the system to serve an RSC response from the original URL, poisoning shared cache entries. Consequently, subsequent visitors receive component payloads instead of the expected HTML. This occurs due to inconsistent validation and interpretation of RSC request headers during request classification and rendering.

Recommendations Update to version 15.5.16. Update to version 16.2.5. Ensure the CDN or reverse proxy keys on relevant RSC request headers and honors Vary. Disable shared caching for affected App Router and RSC responses.

Fix

Weakness Enumeration

CWE-436

Related Identifiers

BDU:2026-07876

CVE-2026-44576

GHSA-WFC6-R584-VFW7

Affected Products

Next.Js

References · 9

• https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44576 · Security Note
• https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07876 · Security Note
• https://github.com/vercel/next.js/releases/tag/v15.5.16 · Note
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/releases/tag/v16.2.5 · Note
• https://t.me/proxy_bar/3371 · Telegram Post
• https://t.me/brutsecurity/2701 · Telegram Post