CVE-2026-44581 is a stored cross-site scripting vulnerability in the Next.js React framework affecting App Router applications that use Content Security Policy (CSP) nonces and are deployed behind shared caches. In affected versions (>=13.4.0, <15.5.16 and >=16.0.0, <16.2.5), malformed nonce values from request headers can be reflected into HTML output without proper neutralization, enabling attackers to poison cached responses. This can lead to script execution in the browsers of subsequent users accessing the cached content. The vulnerability is addressed in Next.js versions 15.5.16 and 16.2.5.

An attacker can exploit this vulnerability to inject malicious scripts into cached responses, resulting in stored cross-site scripting attacks that affect users who receive the poisoned cache content. The impact includes limited confidentiality and integrity loss due to script execution in the victim's browser. There is no direct availability impact. No known exploits are reported in the wild at this time.

Upgrade Next.js to version 15.5.16 or later in the 15.x series, or 16.2.5 or later in the 16.x series, where this vulnerability is fixed. There is no official vendor advisory provided here, but the fix is confirmed in the version ranges specified. Patch status is confirmed by the version information. No additional mitigation steps are indicated.