Interpretation Conflict in Next.js - CVE-2026-44576
Published: May 6, 2026
Vulnerability identifier: #VU130280
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44576
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause cache poisoning that results in component payloads being served instead of the expected HTML.
The vulnerability exists due to interpretation conflict in React Server Component response handling when shared caches do not correctly partition response variants. A remote attacker can cause an RSC response to be served from the original URL to cause cache poisoning that results in component payloads being served instead of the expected HTML.
The issue affects applications using React Server Components with shared caches under affected conditions.
Affected software
Next.js
How to mitigate CVE-2026-44576
Install security update from vendor's website.
Next.js - addressed in versions 15.5.16, 16.2.5