Next.js: Middleware / Proxy redirects can be cache-poisoned
Published May 13, 2026
5.9
MEDIUMCVSS 3.1
EPSS 0.20%
Description
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5.
Affected products
-
- Version >= 12.2.0, < 15.5.16StatusaffectedConstraints-
- Version >= 16.0.0, < 16.2.5StatusaffectedConstraints-
- Version
No data.
Red Hat Enterprise Linux 10
firefox
Fix deferred
Red Hat Enterprise Linux 10
thunderbird
Fix deferred
Red Hat Enterprise Linux 7
firefox
Fix deferred
Red Hat Enterprise Linux 8
firefox
Fix deferred
Red Hat Enterprise Linux 8
thunderbird
Fix deferred
Red Hat Enterprise Linux 9
firefox
Fix deferred
Red Hat Enterprise Linux 9
thunderbird
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-cuda-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-gaudi-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-rocm-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/disk-image-cuda-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/rekor-search-ui-rhel9
Fix deferred
streams for Apache Kafka 2
next
Fix deferred
streams for Apache Kafka 3
next
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | thunderbird | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | thunderbird | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | thunderbird | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-gaudi-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-rocm-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/disk-image-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/rekor-search-ui-rhel9 | Fix deferred | n/a |
| streams for Apache Kafka 2 | next | Fix deferred | n/a |
| streams for Apache Kafka 3 | next | Affected | n/a |
next
npm
Introduced 12.2.0 Fixed 15.5.16next
npm
Introduced 16.0.0 Fixed 16.2.5
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | next | 12.2.0 | 15.5.16 |
| npm | next | 16.0.0 | 16.2.5 |
Remediation
Red Hat mitigation
To mitigate this issue, configure any caching Content Delivery Network (CDN) or reverse proxy deployed in front of Next.js applications to either not cache 3xx redirect responses for paths handled by middleware, or to ensure that the cache key for 3xx responses explicitly varies on the `x-nextjs-data` header. This prevents an attacker from poisoning the cache with an unusable redirect response. Consult your CDN or reverse proxy documentation for specific configuration instructions. A service reload or restart of the CDN/reverse proxy may be required for changes to take effect.
References (8)
- https://access.redhat.com/security/cve/CVE-2026-44572 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2477168 Issue Tracking
- https://github.com/advisories/GHSA-3g8h-86w9-wvmq Advisory
- https://github.com/vercel/next.js/releases/tag/v15.5.16
- https://github.com/vercel/next.js/releases/tag/v16.2.5
- https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq x_refsource_CONFIRMMitigationVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44572
- https://www.cve.org/CVERecord?id=CVE-2026-44572
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-44572 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477168 | Issue Tracking | |
| https://github.com/advisories/GHSA-3g8h-86w9-wvmq | Advisory | |
| https://github.com/vercel/next.js/releases/tag/v15.5.16 | ||
| https://github.com/vercel/next.js/releases/tag/v16.2.5 | ||
| https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq | x_refsource_CONFIRMMitigationVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-44572 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-44572 |
Change history (0)
No recorded changes yet.