vercel next.js up to 15.5.15/16.2.4 React Server interpretation conflict

Summaryinfo

A vulnerability, which was classified as problematic, was found in vercel next.js up to 15.5.15/16.2.4. This vulnerability affects unknown code of the component React Server. Executing a manipulation can lead to interpretation conflict. This vulnerability is tracked as CVE-2026-44576. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in vercel next.js up to 15.5.15/16.2.4. It has been declared as problematic. This vulnerability affects some unknown functionality of the component React Server. The manipulation with an unknown input leads to a interpretation conflict vulnerability. The CWE definition for the vulnerability is CWE-436. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. As an impact it is known to affect integrity, and availability. CVE summarizes:

Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-44576 since 05/06/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 15.5.16 or 16.2.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1401). Once again VulDB remains the best source for vulnerability data.

Affected

• Vercel Next.js

Productinfo

Type

• JavaScript Library

Vendor

• vercel

Name

• next.js

Version

• 15.5.0
• 15.5.1
• 15.5.2
• 15.5.3
• 15.5.4
• 15.5.5
• 15.5.6
• 15.5.7
• 15.5.8
• 15.5.9
• 15.5.10
• 15.5.11
• 15.5.12
• 15.5.13
• 15.5.14
• 15.5.15
• 16.2.0
• 16.2.1
• 16.2.2
• 16.2.3
• 16.2.4

Website

• Product: https://github.com/vercel/next.js/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion