# CVE-2026-44580: Vercel Next.js cross-site scripting in beforeInteractive scripts

Source: https://junglewise.ai/threats/cve-2026-44580-vercel-next-js-xss-in-beforeinteractive-scripts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44580 · Severity: medium · CVSS 6.1 · Published 2026-05-13

Next.js is a popular framework used by developers to build web applications. A security flaw in how it handles certain scripts could allow an attacker to run malicious code in a user's web browser if the application displays untrusted content. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technologies: [next (npm)](https://junglewise.ai/threats/technologies/npm-next), [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-44580 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44580 being exploited in the wild.

**How severe is CVE-2026-44580?** Medium severity, with a CVSS score of 6.1, published 13 May 2026.

**Which products and versions are affected?** next (npm) SEMVER:introduced=13.0.0,fixed=15.5.16; Vercel Next.js >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5, 13.0.0 to < 15.5.16, 16.0.0 to < 16.2.5.

**Is there a fix for CVE-2026-44580?** Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44580 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44580?** Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next (npm): upgrade to 15.5.16 or later

  ```sh
  npm install next@15.5.16
  ```


## Technical details

A cross-site scripting (XSS) vulnerability exists in Next.js when using the 'beforeInteractive' script strategy. The root cause is that serialized script content was not safely HTML-escaped before being embedded into the document. An attacker providing untrusted input can break out of the intended script context to execute arbitrary JavaScript in the context of the victim's browser. This requires the application to be passing untrusted data into a beforeInteractive script and for a user to visit the affected page. The issue is fixed in versions 15.5.16 and 16.2.5 by properly escaping serialized script content.

## Affected products

- Vercel Next.js 13.0.0 to < 15.5.16, 16.0.0 to < 16.2.5

## Identifiers

- CVE-2026-44580
- GHSA-gx5p-jg67-6x7h

## Timeline

- 2026-05-06: advisory: GitHub advisory published by Vercel
- 2026-05-13: disclosed: CVE published to NVD

## References

- [https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)