{"id":"EUVD-2026-30051","enisaUuid":"24ac2d57-5ebb-3b60-bf1e-3bf3a6b7c433","description":"Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5.","datePublished":"May 13, 2026, 3:57:15 PM","dateUpdated":"May 14, 2026, 3:33:10 PM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq\n","aliases":"CVE-2026-44572\nGHSA-3g8h-86w9-wvmq\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"4aa580da-33c2-376c-a987-d2aba023ffd3","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"12.2.0, \u003c 15.5.16"},{"id":"85d9d796-ca67-31ce-87ef-ce0d6af759a3","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.2.5"}],"enisaIdVendor":[{"id":"3373ea07-686f-3e90-9f97-742ed10781e1","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"142b7f7e-5ef6-3886-b7fa-e25de4fa5ff1","vulnerability":{"id":"GHSA-3g8h-86w9-wvmq","description":"Next.js\u0027s Middleware / Proxy redirects can be cache-poisoned","datePublished":"May 11, 2026, 4:12:07 PM","dateUpdated":"May 14, 2026, 8:35:56 PM","baseScore":0.0,"references":"https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44572\nhttps://github.com/vercel/next.js\nhttps://github.com/vercel/next.js/releases/tag/v15.5.16\nhttps://github.com/vercel/next.js/releases/tag/v16.2.5\n","enisa_id":"EUVD-2026-30051\n","aliases":"GHSA-3g8h-86w9-wvmq\nCVE-2026-44572\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"14e306e6-f9f6-3e8f-b2f4-d9866ccc3407","vulnerability":{"id":"CVE-2026-44572","description":"Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5.","datePublished":"May 13, 2026, 3:57:15 PM","dateUpdated":"May 14, 2026, 3:33:10 PM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq\n","enisa_id":"EUVD-2026-30051\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 5, 2026, 7:18:12 AM","vulnerabilityProduct":[{"id":"1c13d6e6-6660-3279-ad51-b8bd6082e635","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"12.2.0, \u003c 15.5.16"},{"id":"38b47fab-9382-38f2-a1e8-398a7ad90ef8","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.2.5"}],"vulnerabilityVendor":[{"id":"4825f588-0186-3ffb-a92c-1dba376e24e5","vendor":{"name":"vercel"}}]}}],"enisaIdAdvisory":[{"id":"29386fa2-57b9-3e7a-b0cc-6363e21e9204","advisory":{"id":"WID-SEC-W-2026-1401","description":"Vercel Next.js: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.","datePublished":"May 6, 2026, 10:00:00 PM","dateUpdated":"May 13, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1401.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1401\n","aliases":"CVE-2026-23870\nCVE-2026-44572\nCVE-2026-44573\nCVE-2026-44574\nCVE-2026-44575\nCVE-2026-44576\nCVE-2026-44577\nCVE-2026-44578\nCVE-2026-44579\nCVE-2026-44580\nCVE-2026-44581\nCVE-2026-44582\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"4e34fb10-e5d0-3e4b-8497-b7a28d0c5bdf","product":{"name":"next.js","vendor":{"name":"vercel"}}},{"id":"6eef55a1-eced-366b-8ed5-72c112ffd47b","product":{"name":"15.5.16","vendor":{"name":"vercel"}}},{"id":"83bd8c68-9fd8-3c45-b4fe-706987676131","product":{"name":"16.2.5","vendor":{"name":"vercel"}}}]}}]}