# CVE-2026-44582: Vercel Next.js cache poisoning in React Server Components

Source: https://junglewise.ai/threats/cve-2026-44582-vercel-next-js-cache-poisoning-in-react-server-components  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44582 · Severity: low · CVSS 3.7 · Published 2026-05-13

Next.js is a popular framework used to build and deploy web applications. A vulnerability in how it handles data updates (React Server Components) could allow an attacker to trick shared web caches into storing the wrong version of a page. This could result in users seeing incorrect or outdated information instead of the intended content.

Technologies: [next (npm)](https://junglewise.ai/threats/technologies/npm-next), [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-44582 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44582 being exploited in the wild.

**How severe is CVE-2026-44582?** Low severity, with a CVSS score of 3.7, published 13 May 2026.

**Which products and versions are affected?** next (npm) SEMVER:introduced=13.4.6,fixed=15.5.16; Vercel Next.js >= 13.4.6, < 15.5.16; >= 16.0.0, < 16.2.5.

**Is there a fix for CVE-2026-44582?** Yes. next (npm): upgrade to 15.5.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44582 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44582?** Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next (npm): upgrade to 15.5.16 or later

  ```sh
  npm install next@15.5.16
  ```


## Technical details

A cache poisoning vulnerability exists in Next.js due to the use of a weak hash (CWE-328) in the '_rsc' cache-busting mechanism. In deployments utilizing shared caches with insufficient response partitioning, an attacker can trigger collisions in the cache-busting value. This allows the attacker to poison cache entries, causing the server to return the wrong response variant for a specific URL. The attack requires high complexity to achieve a practical collision but can be executed over the network without authentication. The issue is resolved in versions 15.5.16 and 16.2.5 by strengthening the cache-busting mechanism.

## Affected products

- Vercel Next.js >= 13.4.6, < 15.5.16; >= 16.0.0, < 16.2.5

## Identifiers

- CVE-2026-44582
- GHSA-vfv6-92ff-j949

## Timeline

- 2026-05-06: advisory: GitHub advisory published by Vercel
- 2026-05-13: disclosed: NVD publication date

## References

- [https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)