CVE-2026-44581

score

<0.1

cvss

4.7

epss

0.2%

published

2026-05-13

kev added

—

first seen

2026-10-21

Next.js 13.4.0 to < 15.5.16 and 16.2.5 contains a stored XSS caused by unsafe reflection of malformed CSP nonce values from request headers in App Router applications behind shared caches, letting attackers execute scripts via poisoned cached responses, exploit requires deployment behind shared caches.