{"id":"CVE-2026-44581","sourceIdentifier":"security-advisories@github.com","published":"2026-05-13T18:16:18.400","lastModified":"2026-10-26T14:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5."},{"lang":"es","value":"Next.js es un React framework para construir aplicaciones web full-stack. Desde 13.4.0 hasta antes de 15.5.16 y 16.2.5, las aplicaciones App Router que dependen de nonces CSP pueden ser vulnerables a cross-site scripting almacenado cuando se despliegan detrás de cachés compartidas. En las versiones afectadas, los valores nonce malformados derivados de los encabezados de solicitud podrían reflejarse en el HTML renderizado de manera insegura, permitiendo a un atacante envenenar las respuestas en caché y causar la ejecución de scripts para visitantes posteriores. Esta vulnerabilidad está corregida en 15.5.16 y 16.2.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vercel","product":"next.js","versions":[{"version":">= 13.4.0, < 15.5.16","status":"affected"},{"version":">= 16.0.0, < 16.2.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-18T14:12:36.531340Z","id":"CVE-2026-44581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*","versionStartIncluding":"13.4.0","versionEndExcluding":"15.5.16","matchCriteriaId":"A9F82F11-CD68-440C-AFAE-98AF7B8DB69F"},{"vulnerable":true,"criteria":"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.2.5","matchCriteriaId":"27C5CF7A-7A33-4BE4-B8FD-10BFD813204A"}]}]}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}