Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

Description

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.

Scores

EPSS (exploitation in 30 days)

0.21% · top 89% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• vercel · next.js

  • affected >= 13.0.0, < 15.5.16
  • affected >= 16.0.0, < 16.2.5

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmnextGHSA-gx5p-jg67-6x7h (opens in a new tab)

References (1)

• https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-gx5p-jg67-6x7h (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-44580](https://trackcve.app/badge/CVE-2026-44580.svg)](https://trackcve.app/cve/CVE-2026-44580)

Record last updated 13 May 2026, 18:28 UTC.