CVE-2026-44580

Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

State: Published
Severity: 6.1 Medium
Published: May 13, 2026
Updated: May 13, 2026
Reserved: May 6, 2026

Description

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
next.jsvercel	>= 13.0.0, < 15.5.16Affected >= 16.0.0, < 16.2.5Affected

References

https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.