CVE-2026-44572 describes a vulnerability in Next.js where middleware handling redirects can be manipulated by an attacker sending a x-nextjs-data header. This causes the middleware or proxy to substitute the standard Location redirect header with an internal x-nextjs-redirect header, which browsers ignore. When deployed behind caching CDNs or proxies that cache 3xx responses without varying on this header, this can lead to cache poisoning of redirect responses. As a result, legitimate users receive unusable redirect responses lacking the Location header, effectively causing a denial of service on the affected redirect paths. The vulnerability affects Next.js versions >= 12.2.0 and < 15.5.16, and >= 16.0.0 and < 16.2.5. It is resolved in versions 15.5.16 and 16.2.5.

The vulnerability can cause denial of service on redirect paths by poisoning cached redirect responses in CDNs or reverse proxies that do not vary cache entries based on the x-nextjs-data header. There is no confidentiality or integrity impact reported. The CVSS score is 3.7 (low severity), reflecting the limited impact and the requirement for specific caching configurations to be vulnerable.

This vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the issue. If upgrading immediately is not possible, ensure that caching CDNs or reverse proxies vary cache keys on the x-nextjs-data header or do not cache 3xx redirect responses for affected paths. Patch status is not explicitly stated in the vendor advisory, but the fixed versions indicate an official fix is available.