CVE-2026-44582: CWE-328: Use of Weak Hash in vercel next.js
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
AI Analysis
Technical Summary
CVE-2026-44582 affects Next.js, a React framework, where React Server Component responses can be poisoned in deployments relying on shared caches lacking proper response partitioning. The vulnerability arises from collisions in the _rsc cache-busting value, enabling attackers to poison cache entries and serve incorrect response variants to users. This issue affects Next.js versions >= 13.4.6 and < 15.5.16, and >= 16.0.0 and < 16.2.5. The vulnerability is resolved in versions 15.5.16 and 16.2.5. The CVSS score is 3.7, indicating low severity, with no known exploits in the wild. No official remediation level or patch links are provided in the data.
Potential Impact
The vulnerability allows an attacker to poison cache entries in shared caching environments, causing users to receive incorrect response variants for a given URL. This impacts data integrity to a limited extent but does not affect confidentiality or availability. The CVSS score of 3.7 and low severity rating reflect this limited impact. There are no known exploits in the wild.
Mitigation Recommendations
The vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed in the vendor advisory content provided, but the description states the issue is fixed in these versions. No additional mitigation steps are indicated.
CVE-2026-44582: CWE-328: Use of Weak Hash in vercel next.js
Description
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
CVSS v3.1
Score 3.7low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44582 affects Next.js, a React framework, where React Server Component responses can be poisoned in deployments relying on shared caches lacking proper response partitioning. The vulnerability arises from collisions in the _rsc cache-busting value, enabling attackers to poison cache entries and serve incorrect response variants to users. This issue affects Next.js versions >= 13.4.6 and < 15.5.16, and >= 16.0.0 and < 16.2.5. The vulnerability is resolved in versions 15.5.16 and 16.2.5. The CVSS score is 3.7, indicating low severity, with no known exploits in the wild. No official remediation level or patch links are provided in the data.
Potential Impact
The vulnerability allows an attacker to poison cache entries in shared caching environments, causing users to receive incorrect response variants for a given URL. This impacts data integrity to a limited extent but does not affect confidentiality or availability. The CVSS score of 3.7 and low severity rating reflect this limited impact. There are no known exploits in the wild.
Mitigation Recommendations
The vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed in the vendor advisory content provided, but the description states the issue is fixed in these versions. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T21:49:12.425Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a04ba26cbff5d8610f4836f
Added to database: 05/13/2026, 17:51:34 UTC
Last enriched: 05/20/2026, 18:44:32 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 130
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.