CVE-2026-44582

[CVE catalog]

Severity

Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Published

May 6, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.21% · Oct 25, 2026

A flaw was found in Next.js. React Server Component responses are vulnerable to cache poisoning in deployments that use shared caches without proper response partitioning. An attacker can exploit collisions in the _rsc cache-busting value to poison cache entries. This allows users to receive incorrect response variants for a given URL, potentially leading to information integrity issues. Next.js: Next.js: Cache poisoning allows incorrect response delivery Low: This flaw in Next.js affects deployments utilizing shared caches without adequate response partitioning. An attacker could leverage collisions in the `_rsc` cache-busting mechanism to poison cache entries, resulting in users receiving unintended content for a given URL. This issue primarily impacts the integrity of cached responses in specific deployment configurations. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.