TL;DR
Two high-severity Next.js issues are now tracked by FrameScan: SSRF in apps using WebSocket upgrades (CVE-2026-44578) and cache poisoning in React Server Component responses (CVE-2026-44576). Affected ranges are next >=13.4.13,<15.5.16 and >=14.2.0,<15.5.16. Upgrade Next.js to 15.5.16. Your upcoming FrameScan runs already include checks for both CVEs.
At-a-glance
| ID | Plain-English impact | Severity | Affected versions | Fixed version |
|---|---|---|---|---|
| CVE-2026-44578 | Server can be tricked to make external requests | high | >=13.4.13,<15.5.16 | 15.5.16 |
| CVE-2026-44576 | Poisoned cache may serve incorrect RSC data | high | >=14.2.0,<15.5.16 | 15.5.16 |
CVE-2026-44578 — Next.js SSRF in WebSocket upgrades
An attacker could coerce the server into making requests to arbitrary hosts during WebSocket upgrade handling, potentially reaching internal services not exposed to the internet. This is high severity and should be addressed promptly, especially for apps that rely on WebSocket connections.
Technical details
Based on the advisory, applications using WebSocket upgrades are affected. The risk is server-side request forgery: the server may initiate network calls derived from untrusted input during the upgrade flow. The fix in Next.js 15.5.16 hardens the upgrade path to prevent request forwarding or dialing to attacker-chosen destinations.
CVE-2026-44576 — Cache poisoning in React Server Component responses
An attacker could manipulate cache entries so that other users are served incorrect or attacker-influenced React Server Component content. This can lead to users seeing wrong data and, depending on usage, potential data exposure or integrity issues. Treat this as high priority in apps using RSC and caching.
Technical details
The advisory states that RSC response caching could be poisoned. The flaw allows crafted requests to affect what later users receive from cache. Next.js 15.5.16 updates caching behavior so RSC responses are keyed and validated correctly, preventing untrusted requests from polluting shared caches.
Remediation
- Upgrade Next.js to 15.5.16:
- npm:
npm install next@15.5.16 - Yarn:
yarn add next@15.5.16 - pnpm:
pnpm add next@15.5.16 - Review the official advisories:
- CVE-2026-44578: https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r
- CVE-2026-44576: https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7
Call to action
- Existing customers: run or schedule a scan at https://framescan.io/scan
- New to FrameScan? Your first scan per verified domain is free: https://framescan.io/#pricing