CVE-2026-44572

score

<0.1

cvss

3.7

epss

0.2%

published

2026-05-13

kev added

—

first seen

2026-10-21

Next.js 12.2.0 to < 15.5.16 and 16.2.5 contains a web cache poisoning vulnerability caused by improper handling of x-nextjs-data header in middleware redirects, letting external clients cause denial of service via poisoned cached redirects, exploit requires attacker to send crafted requests with x-nextjs-data header.