CVE-2026-44580: Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input
Impact
Applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser.
Fix
We now HTML-escape serialized beforeInteractive script content before embedding it into the page, preventing attacker-controlled content from breaking out of the inline script boundary.
Workarounds
If you cannot upgrade immediately, do not pass untrusted data into beforeInteractive scripts. If that pattern is unavoidable, sanitize or escape the content before embedding it.
Other sources
Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44580?
CVE-2026-44580 has a severity rating that indicates it poses a risk of cross-site scripting due to insecure handling of untrusted input in beforeInteractive scripts.
How do I fix CVE-2026-44580?
To fix CVE-2026-44580, upgrade to Next.js version 16.2.5 or 15.5.16 to ensure proper escaping of serialized script content.
Which versions of Next.js are affected by CVE-2026-44580?
CVE-2026-44580 affects Next.js versions between 13.0.0 and 16.2.5, as well as versions from 15.5.16 up to 16.0.0.
What impact does CVE-2026-44580 have on application security?
CVE-2026-44580 can lead to cross-site scripting attacks, enabling attackers to inject malicious scripts into the application.
Is there a workaround for CVE-2026-44580?
While upgrading to a safe version is the recommended approach, temporarily avoiding the use of untrusted content in beforeInteractive scripts can serve as a workaround.