CVE-2026-44581: Vercel Next.js stored XSS in App Router via CSP nonce reflection

CVE-2026-44581 · Severity: medium · CVSS 4.7 · Published 2026-05-13

Next.js is a popular framework used for building web applications. A security flaw in certain versions allows attackers to inject malicious scripts into the website by manipulating security headers. If the site uses a shared cache, this malicious script could be stored and served to other visitors, potentially leading to unauthorized actions or data theft.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-44581 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44581 being exploited in the wild.
How severe is CVE-2026-44581?
Medium severity, with a CVSS score of 4.7, published 13 May 2026.
Which products and versions are affected?
next (npm) SEMVER:introduced=13.4.0,fixed=15.5.16; Vercel Next.js >= 13.4.0, < 15.5.16; >= 16.0.0, < 16.2.5.
Is there a fix for CVE-2026-44581?
Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44581 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44581?
Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next (npm): upgrade to 15.5.16 or later
    npm install next@15.5.16

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Next.js App Router applications that utilize Content Security Policy (CSP) nonces. The root cause is the unsafe reflection of malformed nonce values derived from request headers into the rendered HTML. When an application is deployed behind a shared cache, an attacker can send a request with a crafted nonce header to poison the cache with a malicious payload. Subsequent users receiving the cached response will execute the injected script. The vulnerability is fixed in versions 15.5.16 and 16.2.5 by implementing stricter nonce sanitization and rejecting malformed values.

Affected products

  • Vercel Next.js >= 13.4.0, < 15.5.16; >= 16.0.0, < 16.2.5

Identifiers

  • CVE-2026-44581
  • GHSA-ffhc-5mcf-pf4q

Timeline

  • 2026-05-06: advisory: GitHub advisory published by Vercel
  • 2026-05-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.