CVE-2026-44576 affects Next.js, a React framework, in versions >=14.2.0 and <15.5.16, and >=16.0.0 and <16.2.5. The vulnerability arises from improper partitioning of response variants in shared caches when using React Server Components, leading to cache poisoning. An attacker can cause an RSC response to be served from the original URL, poisoning cache entries so that later visitors receive component payloads instead of HTML. This can result in integrity and availability impacts. The vulnerability is addressed in Next.js versions 15.5.16 and 16.2.5.

The vulnerability allows an attacker to poison shared caches, causing users to receive incorrect component payloads rather than the intended HTML content. This impacts the integrity and availability of the application responses. The CVSS vector indicates no confidentiality impact, but integrity and availability impacts are low. The attack requires network access and has high attack complexity, with no privileges or user interaction needed. There are no known exploits in the wild as of the published date.

A fix is available in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these versions or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying these updates to affected deployments. Patch status is confirmed by the version ranges specified in the description. No additional vendor advisory content is provided, so check official Next.js release notes for confirmation.