PT-2026-39419 · Vercel · Next.Js

Published 2026-05-09 · Updated 2026-05-13 · CVE-2026-44582

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Next.js versions 13.4.6 through 15.5.15 Next.js versions 16.0.0 through 16.2.4

Description React Server Component responses are susceptible to cache poisoning in deployments utilizing shared caches with insufficient response partitioning. Collisions in the rsc cache-busting value allow an attacker to poison cache entries, causing users to receive incorrect response variants for a specific URL.

Recommendations Update to version 15.5.16. Update to version 16.2.5. Ensure intermediary caches correctly honor Vary for RSC-related request headers. Disable shared caching for affected RSC responses.

Fix

Weakness Enumeration

CWE-328

Related Identifiers

BDU:2026-06997

CVE-2026-44582

GHSA-VFV6-92FF-J949

Affected Products

Next.Js

References · 10

• https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06997 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44582 · Security Note
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/releases/tag/v15.5.16 · Note
• https://github.com/vercel/next.js/releases/tag/v16.2.5 · Note
• https://t.me/proxy_bar/3371 · Telegram Post
• https://t.me/four_rays/205 · Telegram Post
• https://t.me/brutsecurity/2701 · Telegram Post