Use of Weak Hash Affecting next package, versions >=13.4.6-canary.0 <15.5.16>=16.0.0-beta.0 <16.2.5
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NEXT-16638677
- published11 May 2026
- disclosed11 May 2026
- creditUnknown
Introduced: 11 May 2026
NewCVE-2026-44582 (opens in a new tab)How to fix?
Upgrade next to version 15.5.16, 16.2.5 or higher.
Overview
next is a react framework.
Affected versions of this package are vulnerable to Use of Weak Hash via collisions in the _rsc cache-busting process. An attacker can manipulate cache entries by crafting requests that cause shared caches to serve incorrect response variants to users. This is only exploitable if deployments rely on shared caches with insufficient response partitioning.
Workaround
This vulnerability can be mitigated by ensuring intermediary caches correctly honor Vary for RSC-related request headers, or by disabling shared caching for affected RSC responses until a patched release is deployed.