Next.js: Cache poisoning via collisions in React Server Component cache-busting
Published May 13, 2026
3.7
LOWCVSS 3.1
EPSS 0.17%
Description
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
Affected products
-
- Version >= 13.4.6, < 15.5.16StatusaffectedConstraints-
- Version >= 16.0.0, < 16.2.5StatusaffectedConstraints-
- Version
No data.
Red Hat Enterprise Linux 10
firefox
Fix deferred
Red Hat Enterprise Linux 10
thunderbird
Fix deferred
Red Hat Enterprise Linux 7
firefox
Fix deferred
Red Hat Enterprise Linux 8
firefox
Fix deferred
Red Hat Enterprise Linux 8
thunderbird
Fix deferred
Red Hat Enterprise Linux 9
firefox
Fix deferred
Red Hat Enterprise Linux 9
thunderbird
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-cuda-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-gaudi-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/bootc-rocm-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3
rhelai3/disk-image-cuda-rhel9
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/rekor-search-ui-rhel9
Fix deferred
streams for Apache Kafka 2
next
Fix deferred
streams for Apache Kafka 3
next
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | thunderbird | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | thunderbird | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | firefox | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | thunderbird | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-gaudi-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-rocm-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/disk-image-cuda-rhel9 | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/rekor-search-ui-rhel9 | Fix deferred | n/a |
| streams for Apache Kafka 2 | next | Fix deferred | n/a |
| streams for Apache Kafka 3 | next | Fix deferred | n/a |
next
npm
Introduced 13.4.6 Fixed 15.5.16next
npm
Introduced 16.0.0 Fixed 16.2.5
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | next | 13.4.6 | 15.5.16 |
| npm | next | 16.0.0 | 16.2.5 |
Remediation
Red Hat statement
Low: This flaw in Next.js affects deployments utilizing shared caches without adequate response partitioning. An attacker could leverage collisions in the `_rsc` cache-busting mechanism to poison cache entries, resulting in users receiving unintended content for a given URL. This issue primarily impacts the integrity of cached responses in specific deployment configurations.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (8)
- https://access.redhat.com/security/cve/CVE-2026-44582 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2477211 Issue Tracking
- https://github.com/advisories/GHSA-vfv6-92ff-j949 Advisory
- https://github.com/vercel/next.js/releases/tag/v15.5.16
- https://github.com/vercel/next.js/releases/tag/v16.2.5
- https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949 x_refsource_CONFIRMMitigationVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44582
- https://www.cve.org/CVERecord?id=CVE-2026-44582
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-44582 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477211 | Issue Tracking | |
| https://github.com/advisories/GHSA-vfv6-92ff-j949 | Advisory | |
| https://github.com/vercel/next.js/releases/tag/v15.5.16 | ||
| https://github.com/vercel/next.js/releases/tag/v16.2.5 | ||
| https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949 | x_refsource_CONFIRMMitigationVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-44582 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-44582 |
Change history (0)
No recorded changes yet.