773 PoCs | 119 CISA KEV

tag

App-Router

Next.js RSC Server-Action DoS via Flight Deserialization (CVE-2026-23870)

CVE-2026-23870 web Patched

CVE-2026-23870webHIGH 7.5Patched2026-05-17Next.js Dynamic Route Injection Auth Bypass (CVE-2026-44574)

CVE-2026-44574 web Patched

CVE-2026-44574webHIGH 8.1Patched2026-05-17Next.js CSP Nonce Cache-Poisoned XSS (CVE-2026-44581)

CVE-2026-44581 web Patched

CVE-2026-44581webMEDIUM 4.7Patched2026-05-17Next.js beforeInteractive Script XSS (CVE-2026-44580)

CVE-2026-44580 web Patched

CVE-2026-44580webMEDIUM 6.1Patched2026-05-17Next.js App Router Segment-Prefetch Middleware Bypass (CVE-2026-44575)

CVE-2026-44575 web Patched

CVE-2026-44575webHIGH 7.5Patched2026-05-17