CVE-2026-44580: Vercel Next.js

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.

Affected products

• Vercel Next.js: from 13.0.0, before 15.5.16 (fixed in 15.5.16); from 16.0.0, before 16.2.5 (fixed in 16.2.5)

Published 2026-05-13. Last modified 2026-06-17.