{"cve":"CVE-2026-44581","nvd":{"published":"2026-05-13T18:16:18.400","modified":"2026-10-26T14:10:00.130","status":"Analyzed","description":"Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","score":4.7},"cwes":["CWE-79"],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q"],"products":["vercel:next.js"],"source":"nvd","synced_at":"2026-10-26T14:27:29.784594657+00:00"},"epss":{"cve":"CVE-2026-44581","score":0.00222,"percentile":0.12721,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-ffhc-5mcf-pf4q","url":"https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q","summary":"Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces","modified":"2026-09-10T03:51:05.447940563Z","packages":[{"ecosystem":"npm","name":"next","purl":"pkg:npm/next","ranges":[">=13.4.0 <15.5.16"],"fixed":["15.5.16"]},{"ecosystem":"npm","name":"next","purl":"pkg:npm/next","ranges":[">=16.0.0 <16.2.5"],"fixed":["16.2.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}