{"id":"EUVD-2026-30082","enisaUuid":"a2c7d9c4-d594-3f1c-bdf4-f525d3d98ad0","description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor\u0027s browser. This vulnerability is fixed in 15.5.16 and 16.2.5.","datePublished":"May 13, 2026, 5:06:05 PM","dateUpdated":"May 13, 2026, 6:28:15 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h\n","aliases":"CVE-2026-44580\nGHSA-gx5p-jg67-6x7h\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"a3068b9c-da19-38f6-86dd-419e9e0a96e6","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.2.5"},{"id":"f319c36b-d18f-39a3-8d87-5b8cda1cf3a1","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"13.0.0, \u003c 15.5.16"}],"enisaIdVendor":[{"id":"3f5793a9-62c6-3c87-a735-0f4b7bbe01b7","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"094ba5fd-6b24-3abb-9e08-098b4cc5478e","vulnerability":{"id":"GHSA-gx5p-jg67-6x7h","description":"Next.js has cross-site scripting in beforeInteractive scripts with untrusted input","datePublished":"May 11, 2026, 3:56:38 PM","dateUpdated":"May 14, 2026, 8:38:28 PM","baseScore":0.0,"references":"https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44580\nhttps://github.com/vercel/next.js\nhttps://github.com/vercel/next.js/releases/tag/v15.5.16\nhttps://github.com/vercel/next.js/releases/tag/v16.2.5\n","enisa_id":"EUVD-2026-30082\n","aliases":"CVE-2026-44580\nGHSA-gx5p-jg67-6x7h\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"1ad5bff9-b25b-3dff-9f8b-b029de0d17b4","vulnerability":{"id":"CVE-2026-44580","description":"Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor\u0027s browser. This vulnerability is fixed in 15.5.16 and 16.2.5.","datePublished":"May 13, 2026, 5:06:05 PM","dateUpdated":"May 13, 2026, 6:28:15 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h\n","enisa_id":"EUVD-2026-30082\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"430bdc5c-de5c-320d-a1c1-485690b9f7a0","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"13.0.0, \u003c 15.5.16"},{"id":"798e5338-740d-3659-a85b-4d45e423cb62","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.2.5"}],"vulnerabilityVendor":[{"id":"5068e076-fac4-3a2d-8482-bea43535f064","vendor":{"name":"vercel"}}]}}],"enisaIdAdvisory":[{"id":"ef4af0d7-92c2-3f16-86f9-3f49ec4b2a91","advisory":{"id":"WID-SEC-W-2026-1401","description":"Vercel Next.js: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.","datePublished":"May 6, 2026, 10:00:00 PM","dateUpdated":"May 13, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1401.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1401\n","aliases":"CVE-2026-23870\nCVE-2026-44572\nCVE-2026-44573\nCVE-2026-44574\nCVE-2026-44575\nCVE-2026-44576\nCVE-2026-44577\nCVE-2026-44578\nCVE-2026-44579\nCVE-2026-44580\nCVE-2026-44581\nCVE-2026-44582\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"4e34fb10-e5d0-3e4b-8497-b7a28d0c5bdf","product":{"name":"next.js","vendor":{"name":"vercel"}}},{"id":"6eef55a1-eced-366b-8ed5-72c112ffd47b","product":{"name":"15.5.16","vendor":{"name":"vercel"}}},{"id":"83bd8c68-9fd8-3c45-b4fe-706987676131","product":{"name":"16.2.5","vendor":{"name":"vercel"}}}]}}]}