CVE-2026-44580 is a cross-site scripting vulnerability in the Next.js React framework affecting versions >=13.0.0 and <15.5.16, and >=16.0.0 and <16.2.5. The issue arises because serialized script content embedded in the document via beforeInteractive scripts is not properly escaped, allowing attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in users' browsers. This vulnerability has been addressed in Next.js versions 15.5.16 and 16.2.5.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a user's browser visiting a vulnerable Next.js application. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). There are no known exploits in the wild at this time.

Upgrade affected Next.js applications to version 15.5.16 or later in the 15.x branch, or 16.2.5 or later in the 16.x branch to apply the official fix. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.