Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN491 _____________________________________________________________________ DATE : 13/05/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running next (npm) versions prior to 15.5.18, 16.2.6. ===================================================================== https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6 https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7 _____________________________________________________________________ Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up High timneutkens published GHSA-26hh-7cqf-hhc6 May 7, 2026 Package next (npm) Affected versions >= 15.2.0 < 15.5.18 >= 16.0.0 < 16.2.6 Patched versions 15.5.18 16.2.6 Description Impact It was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. Refer to CVE-2026-44575 for further details. References CVE CVE-2026-44575 Severity High 7.5/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity None Availability None CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE ID CVE-2026-45109 Weaknesses Weakness CWE-288 _____________________________________________________________________ Middleware / Proxy bypass in App Router applications via segment-prefetch routes High timneutkens published GHSA-267c-6grr-h53f May 6, 2026 Package next (npm) Affected versions >= 15.2.0 < 15.5.16 >= 16.0.0 < 16.2.5 Patched versions 15.5.16 16.2.5 Description Impact App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through *transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. Fix We now include App Router transport variants when generating middleware matchers, so middleware protections are applied consistently to those requests as well as to the normal page URL. Workarounds If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware. Severity High 7.5/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity None Availability None CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE ID CVE-2026-44575 Weaknesses Weakness CWE-288 _____________________________________________________________________ Server-side request forgery in applications using WebSocket upgrades High timneutkens published GHSA-c4j6-fc7j-m34r May 6, 2026 Package next (npm) Affected versions >= 13.4.13 < 15.5.16 >= 16.0.0 < 16.2.5 Patched versions 15.5.16 16.2.5 Description Impact Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. Fix We now apply the same safety checks to WebSocket upgrade handling that already existed for normal HTTP requests, so upgrade requests are only proxied when routing has explicitly marked them as safe external rewrites. Workarounds If you cannot upgrade immediately, do not expose the origin server directly to untrusted networks. If WebSocket upgrades are not required, block them at your reverse proxy or load balancer, and restrict origin egress to internal networks and metadata services where possible. Severity High 8.6/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed Confidentiality High Integrity None Availability None CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE ID CVE-2026-44578 Weaknesses No CWEs _____________________________________________________________________ Middleware / Proxy bypass through dynamic route parameter injection High timneutkens published GHSA-492v-c6pp-mqqv May 6, 2026 Package next (npm) Affected versions >= 15.4.0 < 15.5.16 >= 16.0.0 < 16.2.5 Patched versions 15.5.16 16.2.5 Description Impact Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. Fix We now only honor internal route-parameter normalization in trusted routing flows and ignore externally supplied parameter encodings that should never have been accepted from ordinary requests. Workarounds If you cannot upgrade immediately, enforce authorization in route or page logic instead of relying solely on middleware path matching. Severity High 8.1/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged Confidentiality High Integrity High Availability None CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE ID CVE-2026-44574 Weaknesses Weakness CWE-288 _____________________________________________________________________ Cross-site scripting in App Router applications using CSP nonces Moderate timneutkens published GHSA-ffhc-5mcf-pf4q May 6, 2026 Package next (npm) Affected versions >= 13.4.0 < 15.5.16 >= 16.0.0 < 16.2.5 Patched versions 15.5.16 16.2.5 Description Impact App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. Fix We now reject or ignore malformed nonce values before they are embedded into HTML and apply stricter nonce sanitization so request-derived nonce data cannot break out of the intended attribute context. Workarounds If you cannot upgrade immediately, strip inbound Content-Security-Policy request headers from untrusted traffic. Severity Moderate 4.7/ 10 CVSS v3 base metrics Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Changed Confidentiality Low Integrity Low Availability None CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVE ID CVE-2026-44581 Weaknesses No CWEs _____________________________________________________________________ Denial of Service via connection exhaustion in applications using Cache Components High timneutkens published GHSA-mg66-mrh9-m8jx May 6, 2026 Package next (npm) Affected versions >=15.0.0 < 15.5.16 >=16.0.0 < 16.2.5 Patched versions 15.5.16 16.2.5 Description Impact Applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected configurations, a malicious request can trigger a request-body handling deadlock that leaves connections open for an extended period, consuming file descriptors and server capacity until legitimate users are denied service. Fix We now treat the header used for resuming Partial Prerendered requests as an internal-only header and strip it from untrusted incoming requests. This header should never be accepted directly from external clients. Workarounds If you cannot upgrade immediately, block requests that would be handled by Next.js if they contain the Next-Resume header at the edge. Severity High 7.5/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality None Integrity None Availability High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE ID CVE-2026-44579 Weaknesses No CWEs _____________________________________________________________________ Cache poisoning in React Server Component responses Moderate timneutkens published GHSA-wfc6-r584-vfw7 May 6, 2026 Package next (npm) Affected versions >= 14.2.0 < 15.5.16 >= 16.0.0 < 16.2.5 Patched versions 15.5.16 16.2.5 Description Impact Applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. Fix We now validate and interpret RSC request headers consistently across request classification and rendering, and we enforce the intended cache-busting behavior so RSC payloads are not unexpectedly served from the original URL. Workarounds If you cannot upgrade immediately, ensure your CDN or reverse proxy keys on the relevant RSC request headers and honors Vary, or disable shared caching for affected App Router and RSC responses. Severity Moderate 5.4/ 10 CVSS v3 base metrics Attack vector Network Attack complexity High Privileges required None User interaction None Scope Changed Confidentiality None Integrity Low Availability Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L CVE ID CVE-2026-44576 Weaknesses Weakness CWE-436 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================