Cross-site scripting in Next.js - CVE-2026-44581
Published: May 6, 2026
Vulnerability identifier: #VU130273
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-44581
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script in victims' browsers.
The vulnerability exists due to cross-site scripting in App Router HTML rendering when processing malformed nonce values derived from request headers behind shared caches. A remote attacker can supply a malformed nonce value to poison cached responses and execute arbitrary script in victims' browsers.
User interaction is required, and exploitation affects App Router applications that rely on CSP nonces when deployed behind shared caches.
Affected software
Next.js
How to mitigate CVE-2026-44581
Install security update from vendor's website.
Next.js - addressed in versions 15.5.16, 16.2.5