Quick answers
- Is CVE-2026-44582 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44582 being exploited in the wild.
- How severe is CVE-2026-44582?
- Low severity, with a CVSS score of 3.7, published 13 May 2026.
- Which products and versions are affected?
- next (npm) SEMVER:introduced=13.4.6,fixed=15.5.16; Vercel Next.js >= 13.4.6, < 15.5.16; >= 16.0.0, < 16.2.5.
- Is there a fix for CVE-2026-44582?
- Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44582 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-44582?
- Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- next (npm): upgrade to 15.5.16 or later
npm install next@15.5.16
Technical details
A cache poisoning vulnerability exists in Next.js due to the use of a weak hash (CWE-328) in the '_rsc' cache-busting mechanism. In deployments utilizing shared caches with insufficient response partitioning, an attacker can trigger collisions in the cache-busting value. This allows the attacker to poison cache entries, causing the server to return the wrong response variant for a specific URL. The attack requires high complexity to achieve a practical collision but can be executed over the network without authentication. The issue is resolved in versions 15.5.16 and 16.2.5 by strengthening the cache-busting mechanism.
Affected products
- Vercel Next.js >= 13.4.6, < 15.5.16; >= 16.0.0, < 16.2.5
Identifiers
- CVE-2026-44582
- GHSA-vfv6-92ff-j949
Timeline
- 2026-05-06: advisory: GitHub advisory published by Vercel
- 2026-05-13: disclosed: NVD publication date