CVE-2026-44572

[CVE catalog]

Severity

Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

May 6, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.28% · Oct 25, 2026

A flaw was found in Next.js. An external client could exploit this vulnerability by sending a x-nextjs-data header on a request to a path handled by middleware that returns a redirect. This action could cause the middleware or proxy to incorrectly process the request as a data request, replacing the standard Location redirect header with an internal x-nextjs-redirect header. If the application is deployed behind a caching Content Delivery Network (CDN) or reverse proxy, a malicious request could poison the cached redirect response, leading to a denial of service for subsequent visitors attempting to access the affected path. next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.