Bug 2477209 (CVE-2026-44576)

Summary: CVE-2026-44576 Next.js: Next.js: Cache poisoning vulnerability in React Server Components
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bbrownin, chfoley, eborisov, gotiwari, jgrulich, jhorak, kaycoth, lball, mvyas, ngough, rgodfrey, rhel-process-autobot, swoodman, tpopela, veshanka, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Next.js, a React framework for building web applications. This vulnerability, related to cache poisoning, affects applications utilizing React Server Components (RSC) when shared caches fail to properly partition response variants. A remote attacker can exploit this by causing an RSC response to be served from its original URL, thereby poisoning shared cache entries. As a result, subsequent visitors may receive unexpected component payloads instead of the intended HTML content.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2482508, 2482509, 2482514, 2482510, 2482511, 2482512, 2482513    
Bug Blocks:    

Description OSIDB Bzimport 2026-05-13 18:02:51 UTC 
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.