UpHeron
All vulnerabilities

npm

CVE-2026-44582

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

Severity
Low 3.7
Published
11 May 2026
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.16, 16.2.5
Also known as
GHSA-vfv6-92ff-j949
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 13.4.6 before 15.5.16
  • From 16.0.0 before 16.2.5

References