CVE-2026-44572: Next Next.js's Middleware / Proxy Redirects Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3g8h-86w9-wvmq",
  "modified" : "2026-05-14T20:35:56Z",
  "published" : "2026-05-11T16:12:07Z",
  "aliases" : [ "CVE-2026-44572" ],
  "summary" : "Next.js's Middleware / Proxy redirects can be cache-poisoned",
  "details" : "### Impact\n\nNext.js uses the `x-nextjs-data` request header for internal data requests. On affected versions, an external client could send this header on a normal request to a path handled by middleware that returns a redirect.\n\nWhen that happened, the middleware/proxy could treat the request as a data request and replace the standard `Location` redirect header with the internal `x-nextjs-redirect` header. Browsers do not follow `x-nextjs-redirect`, so the response became an unusable redirect for normal clients.\n\nIf the application was deployed behind a CDN or reverse proxy that caches 3xx responses without varying on this header, a single attacker request could poison the cached redirect response for the affected path. Subsequent visitors could then receive a cached redirect response without a `Location` header, causing a denial of service for that redirect path until the cache entry expired or was purged.\n\n### Affected scenarios\n\nThis affects applications that:\n- use middleware or proxy redirects\n- are deployed behind a caching CDN or reverse proxy\n- allow 3xx responses on those paths to be cached without differentiating internal data requests from normal requests\n\n### Fix\n\nThe fix stops trusting `x-nextjs-data` by itself for middleware redirect handling. A request is now treated as an internal data request only when it is validated as such by internal routing state, preserving legitimate data-request redirect behavior while preventing external header injection from changing normal redirect responses.\n\n### Workarounds\n\nBefore upgrading, users can reduce risk by:\n- configuring the CDN or reverse proxy to vary its cache key on `x-nextjs-data` for affected responses",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "next"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "12.2.0"
      }, {
        "fixed" : "15.5.16"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "next"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "16.0.0"
      }, {
        "fixed" : "16.2.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44572"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/vercel/next.js"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vercel/next.js/releases/tag/v15.5.16"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vercel/next.js/releases/tag/v16.2.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-349" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-11T16:12:07Z",
    "nvd_published_at" : "2026-05-13T16:16:58Z"
  }
}