CVE-2026-44572
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5.
Scoring
- Severity
- LOW
- CVSS base score
- 3.7
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS probability
- 0.30%
- CWE
- CWE-349
- Published
- 2026-05-13
- Last modified
- 2026-05-14
Affected products
- vercel next.js
- vercel next.js
Weakness type
Related vulnerabilities
- CVE-2026-15387 — Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
- CVE-2026-54625 — django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
- CVE-2026-50252 — Possible cache poisoning attack by mapping source port population per thread
- CVE-2026-41120 — Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous...
- CVE-2026-46342 — Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
- CVE-2026-45602 — Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability
- CVE-2026-42960 — Possible cache poisoning via promiscuous records for the authority section
- CVE-2026-32162 — Windows COM Elevation of Privilege Vulnerability