CVE-2026-44580 is a cross-site scripting vulnerability in the Next.js React framework affecting versions >=13.0.0 and <15.5.16, and >=16.0.0 and <16.2.5. The issue arises from improper neutralization of input during web page generation, specifically when using beforeInteractive scripts with untrusted content. Serialized script content was not safely escaped before embedding, allowing attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in the browser. This vulnerability has been addressed in Next.js versions 15.5.16 and 16.2.5.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected web application, potentially leading to information disclosure or manipulation of client-side logic. The CVSS score of 6.1 reflects a medium impact with low complexity and no privileges required, but user interaction is necessary.

Upgrade affected Next.js applications to version 15.5.16 or later, or 16.2.5 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor's versioning information.