Next.js: Cache poisoning via collisions in React Server Component cache-busting
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-44582. PoCs published by dwisiswant0, XZ1r0.
AI-analyzed exploit summary This repository contains functional exploit proof-of-concept code for multiple Next.js vulnerabilities, including detailed write-ups, vulnerable code excerpts, and patch analysis. The PoCs are structured to demonstrate issues like SSRF, XSS, and cache poisoning in Next.js v16.2.4.
Description
Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.
Exploits (2)
This repository contains functional exploit proof-of-concept code for multiple Next.js vulnerabilities, including detailed write-ups, vulnerable code excerpts, and patch analysis. The PoCs are structured to demonstrate issues like SSRF, XSS, and cache poisoning in Next.js v16.2.4.
This repository contains a functional exploit for CVE-2026-44582, demonstrating a weak hash collision in Next.js <16.2.5 that allows RSC cache poisoning. The exploit includes a Python script to find hash collisions and a bash script to automate the process.
References (1)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N