Answer in brief
CVE-2026-44582 records a Low severity vulnerability in Cache poisoning via collisions in React Server Component cache-busting. The current sources do not mark it as known exploited. The current feed maps next (npm), next (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps next (npm), next (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| nextnpm | >=13.4.6<15.5.16 | Not reported |
| nextnpm | >=16.0.0<16.2.5 | Not reported |
Published upstream
May 6, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
May 7, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
### Impact React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the `_rsc` cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. ### Fix We strengthened the `_rsc` cache-busting mechanism to make practical collisions significantly harder and to better separate response variants that should not share cache entries. ### Workarounds If you cannot upgrade immediately, ensure intermediary caches correctly honor `Vary` for RSC-related request headers, or disable shared caching for affected RSC responses until you can deploy a patched release.
Quoted source text, attributed separately from HOL analysis.