CVE-2026-44582

Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions,...

CVE-2026-44582

Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions,...

CVE-2026-44582: Use of Weak Hash

Next.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions,...

Next.js _rsc weak cache-busting hash collision (CVE-2026-44582)

Reimplements the legacy 32-bit FNV-style mix and runs a birthday search for a colliding state-tree, next-url tuple. Optional HTTP GET with RSC prefetch headers can probe CDN cache behaviour. CPU-heavy; patched Next.js uses a stronger mix = 16.2.5. !/usr/bin/env python3 -- coding: utf-8 -- import...