CVE-2026-44576— Next.js 安全漏洞

Next.js: Cache poisoning in React Server Component responses

Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

解释冲突

Next.js 安全漏洞

Next.js是Vercel开源的一个 React 框架。 Next.js 14.2.0至15.5.16之前版本和16.2.5之前版本存在安全漏洞，该漏洞源于使用React Server Components时共享缓存未正确分区响应变体，可能导致缓存投毒，使后续访问者收到组件负载而非预期HTML。

N/A

N/A