CVE-2026-44576 — Next.js is a React framework for building full-stack web
CVE-2026-44576 — Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions
What This Means For You
- If your environment is affected by CWE-436, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2026-44576 updates and patches.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-44576 - Next.js Cache Poisoning Attempt
title: CVE-2026-44576 - Next.js Cache Poisoning Attempt
id: scw-2026-05-13-ai-1
status: experimental
level: medium
description: |
Detects potential cache poisoning attempts targeting Next.js applications (CVE-2026-44576). This rule looks for requests to Next.js static assets that also contain a query parameter indicative of a React Server Component (RSC) payload, which could be used to poison shared cache entries. This is a primary indicator of exploitation for this vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-44576/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/_next/static/'
cs-uri-query|contains:
- 'RSCPayload'
sc-status:
- 200
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-44576 | vulnerability | CVE-2026-44576 |
| CWE-436 | weakness | CWE-436 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 13, 2026 at 20:16 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
vm2 Sandbox Escape (CVE-2026-45411) Poses Critical RCE Risk
CVE-2026-45411 — vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression...
Next.js CVE-2026-45109: Middleware Bypass Via Turbopack
CVE-2026-45109 — Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix...
Next.js Partial Prerendering Vulnerability: DoS via Connection Exhaustion
CVE-2026-44579 — Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache...