Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/next@16.2.0-canary.46
Typenpm
Namespace
Namenext
Version16.2.0-canary.46
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version16.2.6
Latest_non_vulnerable_version16.2.6
Affected_by_vulnerabilities
0
url VCID-2wxy-d9mx-u7du
vulnerability_id VCID-2wxy-d9mx-u7du
summary Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44573.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44573.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44573
reference_id
reference_type
scores
0
value 0.00052
scoring_system epss
scoring_elements 0.16886
published_at 2026-06-13T12:55:00Z
1
value 0.00052
scoring_system epss
scoring_elements 0.16723
published_at 2026-06-11T12:55:00Z
2
value 0.00052
scoring_system epss
scoring_elements 0.16872
published_at 2026-06-12T12:55:00Z
3
value 0.00057
scoring_system epss
scoring_elements 0.18271
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44573
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44573
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44573
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477199
reference_id 2477199
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477199
7
reference_url https://github.com/advisories/GHSA-36qx-fr4f-26g5
reference_id GHSA-36qx-fr4f-26g5
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-36qx-fr4f-26g5
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5
reference_id GHSA-36qx-fr4f-26g5
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T18:10:30Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44573, GHSA-36qx-fr4f-26g5
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2wxy-d9mx-u7du
1
url VCID-4kgz-73xy-xyb2
vulnerability_id VCID-4kgz-73xy-xyb2
summary Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44580
reference_id
reference_type
scores
0
value 0.00012
scoring_system epss
scoring_elements 0.01923
published_at 2026-06-13T12:55:00Z
1
value 0.00012
scoring_system epss
scoring_elements 0.01918
published_at 2026-06-11T12:55:00Z
2
value 0.00012
scoring_system epss
scoring_elements 0.01922
published_at 2026-06-12T12:55:00Z
3
value 0.00014
scoring_system epss
scoring_elements 0.02425
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44580
1
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
2
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
3
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44580
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44580
5
reference_url https://github.com/advisories/GHSA-gx5p-jg67-6x7h
reference_id GHSA-gx5p-jg67-6x7h
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-gx5p-jg67-6x7h
6
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h
reference_id GHSA-gx5p-jg67-6x7h
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-13T18:28:00Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44580, GHSA-gx5p-jg67-6x7h
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4kgz-73xy-xyb2
2
url VCID-5ehn-67ys-73h1
vulnerability_id VCID-5ehn-67ys-73h1
summary Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44579.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44579.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44579
reference_id
reference_type
scores
0
value 0.00019
scoring_system epss
scoring_elements 0.05393
published_at 2026-06-11T12:55:00Z
1
value 0.00019
scoring_system epss
scoring_elements 0.05415
published_at 2026-06-12T12:55:00Z
2
value 0.00019
scoring_system epss
scoring_elements 0.0541
published_at 2026-06-13T12:55:00Z
3
value 0.00021
scoring_system epss
scoring_elements 0.05985
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44579
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44579
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44579
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477193
reference_id 2477193
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477193
7
reference_url https://github.com/advisories/GHSA-mg66-mrh9-m8jx
reference_id GHSA-mg66-mrh9-m8jx
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mg66-mrh9-m8jx
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx
reference_id GHSA-mg66-mrh9-m8jx
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-14T15:33:46Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44579, GHSA-mg66-mrh9-m8jx
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5ehn-67ys-73h1
3
url VCID-6r5c-d48p-9qa4
vulnerability_id VCID-6r5c-d48p-9qa4
summary Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44576.json
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44576.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44576
reference_id
reference_type
scores
0
value 0.00016
scoring_system epss
scoring_elements 0.03944
published_at 2026-06-13T12:55:00Z
1
value 0.00016
scoring_system epss
scoring_elements 0.03936
published_at 2026-06-11T12:55:00Z
2
value 0.00016
scoring_system epss
scoring_elements 0.03954
published_at 2026-06-12T12:55:00Z
3
value 0.00018
scoring_system epss
scoring_elements 0.0472
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44576
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44576
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44576
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477209
reference_id 2477209
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477209
7
reference_url https://github.com/advisories/GHSA-wfc6-r584-vfw7
reference_id GHSA-wfc6-r584-vfw7
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wfc6-r584-vfw7
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7
reference_id GHSA-wfc6-r584-vfw7
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-18T13:45:23Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44576, GHSA-wfc6-r584-vfw7
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6r5c-d48p-9qa4
4
url VCID-93c9-up9w-5fdv
vulnerability_id VCID-93c9-up9w-5fdv
summary Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44577.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44577.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44577
reference_id
reference_type
scores
0
value 0.00018
scoring_system epss
scoring_elements 0.05048
published_at 2026-06-13T12:55:00Z
1
value 0.00018
scoring_system epss
scoring_elements 0.05058
published_at 2026-06-11T12:55:00Z
2
value 0.00018
scoring_system epss
scoring_elements 0.05061
published_at 2026-06-12T12:55:00Z
3
value 0.0002
scoring_system epss
scoring_elements 0.05727
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44577
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44577
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44577
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477194
reference_id 2477194
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477194
7
reference_url https://github.com/advisories/GHSA-h64f-5h5j-jqjh
reference_id GHSA-h64f-5h5j-jqjh
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-h64f-5h5j-jqjh
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh
reference_id GHSA-h64f-5h5j-jqjh
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-14T18:33:40Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44577, GHSA-h64f-5h5j-jqjh
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-93c9-up9w-5fdv
5
url VCID-9r3b-phvp-xfck
vulnerability_id VCID-9r3b-phvp-xfck
summary Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44575.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44575.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44575
reference_id
reference_type
scores
0
value 0.00053
scoring_system epss
scoring_elements 0.17014
published_at 2026-06-13T12:55:00Z
1
value 0.00053
scoring_system epss
scoring_elements 0.16846
published_at 2026-06-11T12:55:00Z
2
value 0.00053
scoring_system epss
scoring_elements 0.17003
published_at 2026-06-12T12:55:00Z
3
value 0.00059
scoring_system epss
scoring_elements 0.18818
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44575
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44575
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44575
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477188
reference_id 2477188
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477188
7
reference_url https://github.com/advisories/GHSA-267c-6grr-h53f
reference_id GHSA-267c-6grr-h53f
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-267c-6grr-h53f
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
reference_id GHSA-267c-6grr-h53f
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T17:48:53Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44575, GHSA-267c-6grr-h53f
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9r3b-phvp-xfck
6
url VCID-b2hu-vcgt-7ydr
vulnerability_id VCID-b2hu-vcgt-7ydr
summary Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44582.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44582.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44582
reference_id
reference_type
scores
0
value 0.0001
scoring_system epss
scoring_elements 0.01269
published_at 2026-06-14T12:55:00Z
1
value 9e-05
scoring_system epss
scoring_elements 0.01081
published_at 2026-06-13T12:55:00Z
2
value 9e-05
scoring_system epss
scoring_elements 0.01077
published_at 2026-06-11T12:55:00Z
3
value 9e-05
scoring_system epss
scoring_elements 0.01075
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44582
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44582
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44582
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477211
reference_id 2477211
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477211
7
reference_url https://github.com/advisories/GHSA-vfv6-92ff-j949
reference_id GHSA-vfv6-92ff-j949
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vfv6-92ff-j949
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949
reference_id GHSA-vfv6-92ff-j949
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value LOW
scoring_system cvssv3.1_qr
scoring_elements
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-14T18:23:45Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44582, GHSA-vfv6-92ff-j949
risk_score 1.6
exploitability 0.5
weighted_severity 3.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-b2hu-vcgt-7ydr
7
url VCID-gh18-cr6c-47hm
vulnerability_id VCID-gh18-cr6c-47hm
summary Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-45109.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-45109.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-45109
reference_id
reference_type
scores
0
value 0.00014
scoring_system epss
scoring_elements 0.028
published_at 2026-06-13T12:55:00Z
1
value 0.00014
scoring_system epss
scoring_elements 0.02808
published_at 2026-06-11T12:55:00Z
2
value 0.00014
scoring_system epss
scoring_elements 0.02817
published_at 2026-06-12T12:55:00Z
3
value 0.00015
scoring_system epss
scoring_elements 0.03205
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-45109
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.18
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.18
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.6
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.6
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-45109
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-45109
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477190
reference_id 2477190
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477190
7
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
reference_id GHSA-267c-6grr-h53f
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f
8
reference_url https://github.com/advisories/GHSA-26hh-7cqf-hhc6
reference_id GHSA-26hh-7cqf-hhc6
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-26hh-7cqf-hhc6
9
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6
reference_id GHSA-26hh-7cqf-hhc6
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T18:39:20Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6
fixed_packages
0
url pkg:npm/next@16.2.6
purl pkg:npm/next@16.2.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.6
aliases CVE-2026-45109, GHSA-26hh-7cqf-hhc6
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gh18-cr6c-47hm
8
url VCID-haxf-nay6-v3hg
vulnerability_id VCID-haxf-nay6-v3hg
summary 
Next.js has a Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
references
0
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
1
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/security/advisories/GHSA-q4gf-8mx6-v5v3
2
reference_url https://vercel.com/changelog/summary-of-cve-2026-23869
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://vercel.com/changelog/summary-of-cve-2026-23869
3
reference_url https://github.com/advisories/GHSA-q4gf-8mx6-v5v3
reference_id GHSA-q4gf-8mx6-v5v3
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q4gf-8mx6-v5v3
fixed_packages
0
url pkg:npm/next@16.2.3
purl pkg:npm/next@16.2.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2wxy-d9mx-u7du
1
vulnerability VCID-4kgz-73xy-xyb2
2
vulnerability VCID-5ehn-67ys-73h1
3
vulnerability VCID-6r5c-d48p-9qa4
4
vulnerability VCID-93c9-up9w-5fdv
5
vulnerability VCID-9r3b-phvp-xfck
6
vulnerability VCID-b2hu-vcgt-7ydr
7
vulnerability VCID-gh18-cr6c-47hm
8
vulnerability VCID-w4pk-pmxb-c7fr
9
vulnerability VCID-wgv6-ermy-yycy
10
vulnerability VCID-xzrf-tsxp-hqeg
11
vulnerability VCID-yddv-cunp-yyd7
12
vulnerability VCID-zrny-u44x-3fh1
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.3
aliases GHSA-q4gf-8mx6-v5v3
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-haxf-nay6-v3hg
9
url VCID-w4pk-pmxb-c7fr
vulnerability_id VCID-w4pk-pmxb-c7fr
summary Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44574.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44574.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44574
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01513
published_at 2026-06-13T12:55:00Z
1
value 0.00011
scoring_system epss
scoring_elements 0.01506
published_at 2026-06-11T12:55:00Z
2
value 0.00011
scoring_system epss
scoring_elements 0.01509
published_at 2026-06-12T12:55:00Z
3
value 0.00013
scoring_system epss
scoring_elements 0.02102
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44574
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44574
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44574
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477207
reference_id 2477207
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477207
7
reference_url https://github.com/advisories/GHSA-492v-c6pp-mqqv
reference_id GHSA-492v-c6pp-mqqv
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-492v-c6pp-mqqv
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv
reference_id GHSA-492v-c6pp-mqqv
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-14T03:56:41Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44574, GHSA-492v-c6pp-mqqv
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-w4pk-pmxb-c7fr
10
url VCID-wgv6-ermy-yycy
vulnerability_id VCID-wgv6-ermy-yycy
summary Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44581.json
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44581.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44581
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.0146
published_at 2026-06-13T12:55:00Z
1
value 0.00011
scoring_system epss
scoring_elements 0.01451
published_at 2026-06-11T12:55:00Z
2
value 0.00011
scoring_system epss
scoring_elements 0.01454
published_at 2026-06-12T12:55:00Z
3
value 0.00012
scoring_system epss
scoring_elements 0.01786
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44581
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44581
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44581
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477191
reference_id 2477191
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477191
7
reference_url https://github.com/advisories/GHSA-ffhc-5mcf-pf4q
reference_id GHSA-ffhc-5mcf-pf4q
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-ffhc-5mcf-pf4q
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q
reference_id GHSA-ffhc-5mcf-pf4q
reference_type
scores
0
value 4.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-18T14:12:36Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44581, GHSA-ffhc-5mcf-pf4q
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wgv6-ermy-yycy
11
url VCID-xzrf-tsxp-hqeg
vulnerability_id VCID-xzrf-tsxp-hqeg
summary Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44572.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44572.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44572
reference_id
reference_type
scores
0
value 8e-05
scoring_system epss
scoring_elements 0.00788
published_at 2026-06-13T12:55:00Z
1
value 8e-05
scoring_system epss
scoring_elements 0.00786
published_at 2026-06-12T12:55:00Z
2
value 9e-05
scoring_system epss
scoring_elements 0.00917
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44572
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44572
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44572
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477168
reference_id 2477168
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477168
7
reference_url https://github.com/advisories/GHSA-3g8h-86w9-wvmq
reference_id GHSA-3g8h-86w9-wvmq
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3g8h-86w9-wvmq
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq
reference_id GHSA-3g8h-86w9-wvmq
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value LOW
scoring_system cvssv3.1_qr
scoring_elements
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-14T15:32:48Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44572, GHSA-3g8h-86w9-wvmq
risk_score 2.6
exploitability 0.5
weighted_severity 5.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xzrf-tsxp-hqeg
12
url VCID-yddv-cunp-yyd7
vulnerability_id VCID-yddv-cunp-yyd7
summary Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44578.json
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44578.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-44578
reference_id
reference_type
scores
0
value 0.07215
scoring_system epss
scoring_elements 0.91838
published_at 2026-06-13T12:55:00Z
1
value 0.07215
scoring_system epss
scoring_elements 0.91801
published_at 2026-06-11T12:55:00Z
2
value 0.07215
scoring_system epss
scoring_elements 0.91829
published_at 2026-06-12T12:55:00Z
3
value 0.07797
scoring_system epss
scoring_elements 0.92193
published_at 2026-06-14T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-44578
2
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
3
reference_url https://github.com/vercel/next.js/releases/tag/v15.5.16
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v15.5.16
4
reference_url https://github.com/vercel/next.js/releases/tag/v16.2.5
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/releases/tag/v16.2.5
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-44578
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-44578
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2477187
reference_id 2477187
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2477187
7
reference_url https://github.com/advisories/GHSA-c4j6-fc7j-m34r
reference_id GHSA-c4j6-fc7j-m34r
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-c4j6-fc7j-m34r
8
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r
reference_id GHSA-c4j6-fc7j-m34r
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-13T18:09:06Z/
url https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases CVE-2026-44578, GHSA-c4j6-fc7j-m34r
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-yddv-cunp-yyd7
13
url VCID-zrny-u44x-3fh1
vulnerability_id VCID-zrny-u44x-3fh1
summary 
Next.js Vulnerable to Denial of Service with Server Components
A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). 

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of service in unpatched environments.
references
0
reference_url https://github.com/vercel/next.js
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js
1
reference_url https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj
2
reference_url https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-w94c-4vhp-22gx
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-23870
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-23870
4
reference_url https://github.com/advisories/GHSA-8h8q-6873-q5fj
reference_id GHSA-8h8q-6873-q5fj
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8h8q-6873-q5fj
5
reference_url https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh
reference_id GHSA-rv78-f8rc-xrxh
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh
fixed_packages
0
url pkg:npm/next@16.2.5
purl pkg:npm/next@16.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gh18-cr6c-47hm
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.5
aliases GHSA-8h8q-6873-q5fj
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zrny-u44x-3fh1
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/next@16.2.0-canary.46