CVE-2026-44582

score

<0.1

cvss

3.7

epss

0.2%

published

2026-05-13

kev added

—

first seen

2026-10-21

Next.js 13.4.6 to before 15.5.16 and 16.2.5 contains a cache poisoning vulnerability caused by collisions in the _rsc cache-busting value in React Server Component responses, letting attackers poison shared caches to serve incorrect response variants, exploit requires shared cache with insufficient response partitioning.