CVE-2026-44572

{"id": "CVE-2026-44572", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44572", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T15:32:48.568772Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vercel", "product": "next.js", "versions": [{"status": "affected", "version": ">= 12.2.0, < 15.5.16"}, {"status": "affected", "version": ">= 16.0.0, < 16.2.5"}]}]}], "published": "2026-05-13T16:16:58.800", "references": [{"url": "https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-349"}]}], "descriptions": [{"lang": "en", "value": "Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a Location header, causing a denial of service for that redirect path until the cache entry expired or was purged. This vulnerability is fixed in 15.5.16 and 16.2.5."}, {"lang": "es", "value": "Next.js es un React framework para construir aplicaciones web full-stack. Desde 12.2.0 hasta antes de 15.5.16 y 16.2.5, un cliente externo pod\u00eda enviar un encabezado x-nextjs-data en una solicitud normal a una ruta manejada por middleware que devuelve una redirecci\u00f3n. Cuando eso suced\u00eda, el middleware/proxy pod\u00eda tratar la solicitud como una solicitud de datos y reemplazar el encabezado de redirecci\u00f3n est\u00e1ndar Location con el encabezado interno x-nextjs-redirect. Los navegadores no siguen x-nextjs-redirect, por lo que la respuesta se convert\u00eda en una redirecci\u00f3n inutilizable para clientes normales. Si la aplicaci\u00f3n estaba desplegada detr\u00e1s de una CDN o proxy inverso que almacena en cach\u00e9 respuestas 3xx sin variar en este encabezado, una \u00fanica solicitud de atacante pod\u00eda envenenar la respuesta de redirecci\u00f3n almacenada en cach\u00e9 para la ruta afectada. Los visitantes subsiguientes pod\u00edan entonces recibir una respuesta de redirecci\u00f3n almacenada en cach\u00e9 sin un encabezado Location, causando una denegaci\u00f3n de servicio para esa ruta de redirecci\u00f3n hasta que la entrada de cach\u00e9 expirara o fuera purgada. Esta vulnerabilidad est\u00e1 corregida en 15.5.16 y 16.2.5."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "31A12CFA-9A52-4285-B5F3-E5FAD69DF477", "versionEndExcluding": "15.5.16", "versionStartIncluding": "12.2.0"}, {"criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "27C5CF7A-7A33-4BE4-B8FD-10BFD813204A", "versionEndExcluding": "16.2.5", "versionStartIncluding": "16.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}