CVE-2026-44576: Next.js: Cache poisoning in React Server Component responses
Impact
Applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML.
Fix
We now validate and interpret RSC request headers consistently across request classification and rendering, and we enforce the intended cache-busting behavior so RSC payloads are not unexpectedly served from the original URL.
Workarounds
If you cannot upgrade immediately, ensure your CDN or reverse proxy keys on the relevant RSC request headers and honors Vary, or disable shared caching for affected App Router and RSC responses.
Other sources
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44576?
The severity of CVE-2026-44576 is critically high due to the risk of cache poisoning in React Server Components.
How do I fix CVE-2026-44576?
To fix CVE-2026-44576, upgrade to Next.js version 16.2.5 or 15.5.16, which contain the necessary patches.
What systems are affected by CVE-2026-44576?
CVE-2026-44576 affects Next.js applications using versions between 14.2.0 and 16.2.5.
Can CVE-2026-44576 lead to data leakage?
Yes, CVE-2026-44576 can potentially lead to data leakage by serving incorrect cached responses to users.
Is CVE-2026-44576 a known vulnerability?
Yes, CVE-2026-44576 is a publicly known vulnerability as documented in security advisories.