LowGHSA-vfv6-92ff-j949CVE-2026-44582

Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

Published 11 May 2026 · Updated 10 Sept 2026

Affected packages

nextnpm

Affected: >=13.4.6 <15.5.16
Fixed in: 15.5.16

Update to the fixed version for your release line, for example:npm install next@15.5.16

nextnpm

Affected: >=16.0.0 <16.2.5
Fixed in: 16.2.5

Update to the fixed version for your release line, for example:npm install next@16.2.5

Details

Impact

React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL.

Fix

We strengthened the _rsc cache-busting mechanism to make practical collisions significantly harder and to better separate response variants that should not share cache entries.

Workarounds

If you cannot upgrade immediately, ensure intermediary caches correctly honor Vary for RSC-related request headers, or disable shared caching for affected RSC responses until you can deploy a patched release.

Is GHSA-vfv6-92ff-j949 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.