UpHeron
All vulnerabilities

npm

CVE-2026-44572

Next.js's Middleware / Proxy redirects can be cache-poisoned

Severity
Low 3.7
Published
11 May 2026
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.16, 16.2.5
Also known as
GHSA-3g8h-86w9-wvmq
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 12.2.0 before 15.5.16
  • From 16.0.0 before 16.2.5

References