Packages / next / Security

LowVulnerabilityGHSA-vfv6-92ff-j949CVE-2026-44582Published 11 May 2026

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

Affected releases · next

  • 16.x16.0.0 – 16.2.4Fixed in 16.2.5
  • 15.x15.0.0 – 15.5.15Fixed in 15.5.16
  • 14.x14.0.0 – 14.2.35No fix on this line yet
  • 13.x13.4.6 – 13.5.11No fix on this line yet

On 16.x, the newest line:

npm install next@16.2.5
16.x

  1. Affected

    16.0.0 – 16.2.4

    25 releases

  2. Fixed

    16.2.5 – 16.4.2

    20 releases, latest

15.x

  1. Affected

    15.0.0 – 15.5.15

    70 releases

  2. Fixed

    15.5.16 – 15.5.28

    12 releases

14.x

  1. Affected

    14.0.0 – 14.2.35

    46 releases

13.x

  1. Not affected

    13.0.0 – 13.4.5

    31 releases

  2. Affected

    13.4.6 – 13.5.11

    25 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL.

Fix

We strengthened the _rsc cache-busting mechanism to make practical collisions significantly harder and to better separate response variants that should not share cache entries.

Workarounds

If you cannot upgrade immediately, ensure intermediary caches correctly honor Vary for RSC-related request headers, or disable shared caching for affected RSC responses until you can deploy a patched release.