CVE-2026-44576

score

<0.1

cvss

5.4

epss

0.3%

published

2026-05-13

kev added

—

first seen

2026-10-21

Next.js 14.2.0 to < 15.5.16 and 16.2.5 contains a cache poisoning vulnerability caused by improper partitioning of response variants in React Server Components, letting attackers poison shared caches to serve malicious payloads, exploit requires shared cache usage.