CVE-2026-44580 Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input
Attackers can execute arbitrary JavaScript in visitors' browsers via untrusted input in beforeInteractive scripts, affecting Next.js applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44580?
CVE-2026-44580 is a medium-severity cross-site scripting vulnerability in Vercel Next.js, published on 13 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.
Weakness: CWE-79
Which versions are affected by CVE-2026-44580?
4 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 13.0.0 | 15.5.16 |
next npm | From 13.0.0 | 15.5.16 |
next npm | From 16.0.0 | 16.2.5 |
next npm | From 16.0.0 | 16.2.5 |
Products include Vercel Next.js.
How do I fix CVE-2026-44580?
Upgrade next to a fixed version for your release line: 15.5.16 or 16.2.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-44580 being exploited?
There is no known exploitation of CVE-2026-44580 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as CLEANSTART-2026-SO65050, CLEANSTART-2026-UT46533, GHSA-gx5p-jg67-6x7h, MINI-48p6-4v42-3697, MINI-5qjj-2g2j-7h5x, MINI-gwcj-4v53-358j and 2 more.