Next.js: Cache poisoning in React Server Component responses
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-44576. PoCs published by dwisiswant0, XZ1r0.
AI-analyzed exploit summary This repository contains functional exploit proof-of-concept code for multiple CVEs affecting Next.js v16.2.4, including SSRF, XSS, DoS, and cache poisoning vulnerabilities. The PoCs are well-documented with detailed writeups, vulnerable code excerpts, and harnesses for testing.
Description
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
Exploits (2)
This repository contains functional exploit proof-of-concept code for multiple CVEs affecting Next.js v16.2.4, including SSRF, XSS, DoS, and cache poisoning vulnerabilities. The PoCs are well-documented with detailed writeups, vulnerable code excerpts, and harnesses for testing.
This repository contains a functional exploit for CVE-2026-44576, demonstrating an RSC HTML cache poisoning vulnerability in Next.js versions prior to 16.2.5. The exploit leverages a loose RSC header check and URL-suffix misclassification to poison shared CDN caches, serving RSC binary payloads as text/html.
References (1)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L