CVE-2026-44576

A flaw was found in Next.js, a React framework for building web applications. This vulnerability, related to cache poisoning, affects applications utilizing React Server Components (RSC) when shared caches fail to properly partition response variants. A remote attacker can exploit this by causing an RSC response to be served from its original URL, thereby poisoning shared cache entries. As a result, subsequent visitors may receive unexpected component payloads instead of the intended HTML content.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To address this cache poisoning vulnerability in Next.js applications utilizing React Server Components, ensure that any shared caching mechanisms are configured to correctly partition responses. This involves defining cache keys that incorporate all relevant request parameters and headers to prevent serving incorrect content from the cache. Review the documentation for your specific caching solution (e.g., CDN, reverse proxy, or application-level cache) to implement robust cache key strategies and variant handling. Improper cache configuration can lead to an attacker poisoning cache entries, affecting subsequent users.