FRAMESCAN
← Blog

Next.js high‑severity XSS and cache‑poisoning risks now detected (CVE-2026-44581, CVE-2026-44582)

FrameScan · 2026-07-22

TL;DR

Two high‑severity issues affect Next.js App Router apps. If you use Content Security Policy (CSP) nonces, you may be exposed to cross‑site scripting (CVE-2026-44581). A separate issue allows cache poisoning from collisions in React Server Component cache‑busting (CVE-2026-44582). Update next to 15.5.16. Your upcoming scheduled FrameScan checks already include these detections.

At‑a‑glance

ID Impact Severity Affected versions Fixed version
CVE-2026-44581 XSS risk in App Router with CSP nonces high >=13.4.0,<15.5.16 15.5.16
CVE-2026-44582 Cache poisoning via RSC cache‑busting collisions high >=13.4.6,<15.5.16 15.5.16

CVE-2026-44581 — XSS in App Router apps using CSP nonces

An attacker could inject malicious scripts into pages that rely on CSP nonces, potentially leading to account compromise or data theft. Treat this as high urgency for any App Router project that sets CSP with nonces.

Technical details

Summary data indicates a cross‑site scripting issue specifically when CSP nonces are used in App Router applications. In general, XSS occurs when untrusted content is rendered as HTML/JS and permitted by a CSP rule due to nonce handling. The fix in Next.js 15.5.16 addresses the framework behavior; upgrading removes the vulnerable pattern.

Illustrative example — not Next.js source:

// Vulnerable pattern (illustrative): rendering unsanitized HTML while also attaching a CSP nonce
// makes it easier for injected content to execute if nonce handling is flawed.
import React from 'react';

type Props = { htmlFromUser: string; nonce: string };

export function DangerousContent({ htmlFromUser, nonce }: Props) {
  return (
    <div>
      {/* Using dangerouslySetInnerHTML on untrusted input is risky */}
      <div dangerouslySetInnerHTML={{ __html: htmlFromUser }} />
      {/* A script with a valid nonce can execute even if CSP is otherwise strict */}
      <script nonce={nonce}>{`console.log('inline script');`}</script>
    </div>
  );
}

Fixed pattern (illustrative): avoid rendering raw HTML from untrusted sources and prefer safe escaping; keep scripts external where possible. Upgrade to 15.5.16 to receive the framework fix.

import React from 'react';

// Render untrusted data as text, not HTML.
export function SafeContent({ textFromUser }: { textFromUser: string }) {
  return <p>{textFromUser}</p>;
}

CVE-2026-44582 — Cache poisoning via React Server Component cache‑busting collisions

Attackers could pollute cached responses so other users receive incorrect or attacker‑influenced content. This can undermine integrity, cause data leakage between users, or serve stale or misleading pages. Treat as high urgency for any site relying on server‑side caching of RSC output.

Technical details

Summary data indicates collisions in cache‑busting for React Server Components could allow poisoning. When two distinct requests map to the same cache key, a crafted response may be reused incorrectly. The fix in Next.js 15.5.16 updates the framework’s cache‑busting behavior.

Illustrative example — not Next.js source:

// Vulnerable pattern (illustrative): custom cache key omits differentiating inputs
// leading distinct requests to collide.

type KeyParts = { pathname: string; locale?: string };

function makeWeakCacheKey({ pathname }: KeyParts): string {
  // Collides across users, headers, and search params
  return `rsc:${pathname}`;
}

// Fixed pattern (illustrative): include all relevant dimensions so distinct
// requests do not collide. Framework upgrade enforces safer behavior.
function makeStrongerCacheKey(
  { pathname, locale }: KeyParts,
  searchParams: URLSearchParams,
  userId?: string
): string {
  const qp = searchParams.toString();
  const uid = userId ?? 'anon';
  const loc = locale ?? 'default';
  return `rsc:${pathname}|loc=${loc}|uid=${uid}|qp=${qp}`;
}

Remediation

Call to action

Is your site exposed? Scan it for $1 →