Executive brief
Next.js, a popular React framework for building web applications, uses internal request headers to distinguish between internal data requests and normal user requests. An attacker can forge one of these headers on normal requests to redirect endpoints, causing cached responses to lose their redirect information and become unusable. If deployed behind a CDN or proxy that caches these responses, a single attack can break redirects for all users until the cache clears, resulting in a denial of service.
Technical details
The vulnerability is an improper input validation issue (CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data). Next.js relies on the x-nextjs-data request header to identify internal data requests for middleware redirect handling. An external attacker can inject this header into normal requests, causing middleware to replace the standard HTTP Location redirect header with the internal x-nextjs-redirect header, which browsers do not follow. On systems with caching CDNs or reverse proxies that do not vary cache keys by this header, a single attacker request can poison the redirect for all subsequent visitors, causing denial of service. The fix validates that requests are actually internal data requests using internal routing state rather than trusting the header alone. Affected versions are 12.2.0 through 15.5.15 and 16.0.0 through 16.2.4; patches are available in 15.5.16 and 16.2.5.
Affected products
- Vercel Next.js 12.2.0 to 15.5.15, 16.0.0 to 16.2.4
Timeline
- 2026-05-11: disclosed: GHSA-3g8h-86w9-wvmq published
- 2026-05-06: patched: Patch released in versions 15.5.16 and 16.2.5