4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44581

CVE-2026-44581: Next.js: Cross-site scripting in App Router applications using CSP nonces

Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed in 15.5.16 and 16.2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44581

CVE-2026-44581:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
next	npm	>= 13.4.0, < 15.5.16	15.5.16
next	npm	>= 16.0.0, < 16.2.5	16.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because Next.js applications using the App Router and Content Security Policy (CSP) with nonces were susceptible to a stored cross-site scripting (XSS) attack. The root cause was twofold:

Improper Nonce Validation: The function getScriptNonceFromHeader in packages/next/src/server/app-render/get-script-nonce-from-header.tsx failed to properly validate and sanitize the nonce value extracted from the Content-Security-Policy HTTP request header. It used a weak method to parse the nonce, allowing malformed and malicious strings (e.g., containing HTML characters like " or >) to be accepted as valid nonces.
Lack of Output Escaping: The nonce value, once extracted, was insecurely embedded directly into script tags in the HTML response by functions like createServerInsertedMetadata and createInlinedDataReadableStream. These functions did not perform the necessary HTML attribute escaping on the nonce value.

An attacker could exploit this by sending a request with a crafted Content-Security-Policy header containing a malicious nonce. If the response was stored in a shared cache, subsequent users accessing that cached page would have their browsers execute the malicious script embedded in the response. The patch addresses this by implementing strict validation of the nonce format using a regular expression and ensuring that the nonce is always properly escaped using a new htmlEscapeAttributeString function before being included in the HTML.

Vulnerable functions

getScriptNonceFromHeader

packages/next/src/server/app-render/get-script-nonce-from-header.tsx

The original implementation of `getScriptNonceFromHeader` was vulnerable because it did not properly validate the format of the CSP nonce value extracted from the request header. It used a weak method to find a string starting with 'nonce-' and performed an insufficient check for HTML escape characters. An attacker could provide a malformed nonce in the `Content-Security-Policy` request header, which would be incorrectly parsed and passed on to be rendered in the HTML response, leading to a cross-site scripting vulnerability. The patch replaces this weak parsing with a strict regular expression (`CSP_NONCE_SOURCE_REGEX`) that only allows valid base64-like nonce values.

createServerInsertedMetadata

packages/next/src/server/app-render/metadata-insertion/create-server-inserted-metadata.tsx

This function is responsible for creating a script tag to be inserted into the server-side rendered HTML. Before the patch, it directly embedded the `nonce` value into the script tag's `nonce` attribute without proper HTML attribute escaping. If `getScriptNonceFromHeader` returned a malicious, unescaped string, it would be rendered as-is, allowing an attacker to break out of the `nonce` attribute and inject arbitrary HTML, leading to XSS. The fix introduces `htmlEscapeAttributeString` to sanitize the nonce before rendering.

createInlinedDataReadableStream

packages/next/src/server/app-render/use-flight-response.tsx

This function creates a readable stream for inlined data, which includes a script tag. The vulnerable version used `JSON.stringify` to embed the nonce into the script tag. This is not a secure way to escape a value for an HTML attribute. A crafted nonce could be used to inject malicious attributes or content. The patch fixes this by using `htmlEscapeAttributeString` to properly escape the nonce value, preventing an attacker from breaking out of the attribute's context.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.