{"id":"GHSA-3g8h-86w9-wvmq","revision":"c376c564bcd940759cfdc46482d176d3","records":[{"revision":"c376c564bcd940759cfdc46482d176d3","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-3g8h-86w9-wvmq","aliases":["CVE-2026-44572"],"title":"Next.js's Middleware / Proxy redirects can be cache-poisoned","description":"### Impact\n\nNext.js uses the `x-nextjs-data` request header for internal data requests. On affected versions, an external client could send this header on a normal request to a path handled by middleware that returns a redirect.\n\nWhen that happened, the middleware/proxy could treat the request as a data request and replace the standard `Location` redirect header with the internal `x-nextjs-redirect` header. Browsers do not follow `x-nextjs-redirect`, so the response became an unusable redirect for normal clients.\n\nIf the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a `Location` header, causing a denial of service for that redirect path until the cache entry expired or was purged.\n\n### Affected scenarios\n\nThis affects applications that:\n- use middleware or proxy redirects\n- are deployed behind a caching CDN or reverse proxy\n- allow 3xx responses on those paths to be cached without differentiating internal data requests from normal requests\n\n### Fix\n\nThe fix stops trusting `x-nextjs-data` by itself for middleware redirect handling. A request is now treated as an internal data request only when it is validated as such by internal routing state, preserving legitimate data-request redirect behavior while preventing external header injection from changing normal redirect responses.\n\n### Workarounds\n\nBefore upgrading, users can reduce risk by:\n- configuring the CDN or reverse proxy to vary its cache key on `x-nextjs-data` for affected responses","state":0,"publishedAt":"2026-05-11T16:12:07+00:00","modifiedAt":"2026-09-10T03:51:04.4229546+00:00","affected":[{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"12.2.0"},{"kind":"fixed","version":"15.5.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"next","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"16.0.0"},{"kind":"fixed","version":"16.2.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq","https://nvd.nist.gov/vuln/detail/CVE-2026-44572","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v15.5.16","https://github.com/vercel/next.js/releases/tag/v16.2.5"],"sourceUrl":"https://github.com/advisories/GHSA-3g8h-86w9-wvmq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3g8h-86w9-wvmq","identifiers":["GHSA-3g8h-86w9-wvmq","CVE-2026-44572"]},"retained":false,"historicalAffected":[]}],"coverage":[]}