vercel next.js up to 15.5.15/16.2.4 React Server _rsc weak hash

Summaryinfo

A vulnerability has been found in vercel next.js up to 15.5.15/16.2.4 and classified as problematic. This affects the function _rsc of the component React Server. The manipulation leads to weak hash. This vulnerability is referenced as CVE-2026-44582. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in vercel next.js up to 15.5.15/16.2.4 and classified as problematic. This issue affects the function _rsc of the component React Server. The manipulation with an unknown input leads to a weak hash vulnerability. Using CWE to declare the problem leads to CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). Impacted is integrity. The summary by CVE is:

Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-44582 since 05/06/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 318351 (Linux Distros Unpatched Vulnerability : CVE-2026-44582), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 15.5.16 or 16.2.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (318351) and CERT Bund (WID-SEC-2026-1401). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Vercel Next.js

Productinfo

Type

• JavaScript Library

Vendor

• vercel

Name

• next.js

Version

• 15.5.0
• 15.5.1
• 15.5.2
• 15.5.3
• 15.5.4
• 15.5.5
• 15.5.6
• 15.5.7
• 15.5.8
• 15.5.9
• 15.5.10
• 15.5.11
• 15.5.12
• 15.5.13
• 15.5.14
• 15.5.15
• 16.2.0
• 16.2.1
• 16.2.2
• 16.2.3
• 16.2.4

Website

• Product: https://github.com/vercel/next.js/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion