CVE-2026-44572
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Next.js in versions 12.2.0 through 15.5.15 and 16.2.4 allows an external client to send an x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. The middleware may treat the request as a data request and replace the Location header with the internal x-nextjs-redirect header, which browsers do not follow. If the application is behind a CDN or reverse proxy caching 3xx responses without varying on this header, a single attacker request can poison the cache and cause denial of service for that redirect path.
Risk Assessment
An attacker can poison the CDN/proxy cache, causing subsequent users to receive invalid redirects without a Location header. This leads to denial of service for the affected path until the cache entry expires or is purged.
Recommendation
Update Next.js to version 15.5.16 or 16.2.5. Configure the CDN/proxy to include the x-nextjs-data header in the cache key or not cache 3xx responses.
Other vulnerabilities in Next.js
See all- CVE-2017-16877High
Next.js before 2.4.1 has a directory traversal vulnerability in the /_next and /static request namespace, allowing attackers to obtain sensitive information.
- CVE-2026-75604Critical
Next.js, a React framework for full-stack applications, versions 13.4.0 through 15.5.24 and 16.3.3, on Windows-hosted servers does not properly escape backslashes in route segments when constructing cache paths, allowing a remote attacker to traverse outside the cache root and expose private data, including the server-reference-manifest encryption key. Disclosure of this key can enable remote code execution. Fixed in versions 15.5.24 and 16.3.3.
- CVE-2026-44578High
Next.js versions from 13.4.13 to before 15.5.16 and 16.2.5 are vulnerable to server-side request forgery (SSRF) via crafted WebSocket upgrade requests. An attacker can force the server to proxy requests to arbitrary internal or external destinations, potentially exposing internal services or cloud metadata endpoints.
- GHSA-673q-mjm6-r5xrCritical
A vulnerability in applications using the App router with the Cache Component can lead to remote code execution. The application must have a `use cache` function that returns multiple typed arrays.
- CVE-2026-94482High
Next.js from 13.0.0 until 15.5.28 and 16.4.1 has a vulnerability where crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. The issue is fixed in versions 15.5.28 and 16.4.1.
- CVE-2026-94544Medium
Next.js versions 16.3.0 through 16.3.8 share cache fills for the same key without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the regular request prerenders a page, the draft-dependent content can persist in the generated page and be served to later visitors until revalidation. Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed in version 16.3.8.
- CVE-2026-94543Medium
Next.js versions 15.0.0 through 15.5.27 and 16.3.8 for self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.
- CVE-2026-94486Medium
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.
- CVE-2026-94485Medium
Next.js versions 16.0.0 through 16.3.8 in the `next dev` development server expose a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.
- CVE-2026-94484Medium
Next.js versions 15.0.0 through 15.5.27 and 16.3.8 for applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.
Original NVD description (English source)
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS