CVE-2026-44572

{
  "id": "CVE-2026-44572",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T16:16:58.800",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5."
    },
    {
      "lang": "es",
      "value": "Next.js es un React framework para construir aplicaciones web full-stack. Desde 12.2.0 hasta antes de 15.5.16 y 16.2.5, un cliente externo podía enviar un encabezado x-nextjs-data en una solicitud normal a una ruta manejada por middleware que devuelve una redirección. Cuando eso sucedía, el middleware/proxy podía tratar la solicitud como una solicitud de datos y reemplazar el encabezado de redirección estándar Location con el encabezado interno x-nextjs-redirect. Los navegadores no siguen x-nextjs-redirect, por lo que la respuesta se convertía en una redirección inutilizable para clientes normales. Si la aplicación estaba desplegada detrás de una CDN o proxy inverso que almacena en caché respuestas 3xx sin variar en este encabezado, una única solicitud de atacante podía envenenar la respuesta de redirección almacenada en caché para la ruta afectada. Los visitantes subsiguientes podían entonces recibir una respuesta de redirección almacenada en caché sin un encabezado Location, causando una denegación de servicio para esa ruta de redirección hasta que la entrada de caché expirara o fuera purgada. Esta vulnerabilidad está corregida en 15.5.16 y 16.2.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "vercel",
          "product": "next.js",
          "versions": [
            {
              "version": ">= 12.2.0, < 15.5.16",
              "status": "affected"
            },
            {
              "version": ">= 16.0.0, < 16.2.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T15:32:48.568772Z",
          "id": "CVE-2026-44572",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-349"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "12.2.0",
              "versionEndExcluding": "15.5.16",
              "matchCriteriaId": "31A12CFA-9A52-4285-B5F3-E5FAD69DF477"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "16.0.0",
              "versionEndExcluding": "16.2.5",
              "matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}