CVE-2026-44580PoC(vercel / next.js)

LOWCVSS 6.1 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for vercel next.js systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vulnerability is fixed in 15.5.16 and 16.2.5.

vercel CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

next.js

Threat summary

Public PoC and exploit tooling are both present
6 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 3 signals
PoC mentioned or linked in 6 signals
Peaked 2d ago at 2 mentions (2026-05-09); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

vercel

Products

next.js

Deep dive

Activity timeline6 mentions / 4d

Signal classification1 categories

PoC

6100.0%

Referenced assets1 URL

By indicator

https://github.com/dwisiswant0/next-16.2.4-pocs

Classification over time

Date	Total	Labels

2026-05-08	1	PoC1
2026-05-09	2	PoC2
2026-05-10	2	PoC2
2026-05-11	1	PoC1

Full discourse6 posts

dw1@dwisiswant0152d
PoC
CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572 https://github.com/dwisiswant0/next-16.2.4-pocs
Post summary
The text lists multiple CVE identifiers and provides a link to a GitHub repository that presumably hosts proof‑of‑concept code, but it lacks details on patches, active exploitation, or technical specifics.
4126765045576.6K
16.0K followersView on X
Nicolas Krassas@Dinosn151d
PoC
Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572) https://github.com/dwisiswant0/next-16.2.4-pocs
Post summary
A GitHub repository hosts proof‑of‑concept exploit code for several Next.js 16.2.4 CVEs, with no evidence of active exploitation or patch information.
144220813713.7K
158.6K followersView on X
Psycho 🎭@Psycho10k_150d
PoC
Next.js v16.2.4 Security PoC Collection CVE-2026-23870 CVE-2026-44575 CVE-2026-44579 CVE-2026-44574 CVE-2026-44578 CVE-2026-44573 CVE-2026-44581 CVE-2026-44580 CVE-2026-44577 CVE-2026-44576 CVE-2026-44582 CVE-2026-44572 https://github.com/dwisiswant0/next-16.2.4-pocs via: Pr0xy
Post summary
The post shares a GitHub repository containing proof‑of‑concept code for a collection of Next.js CVEs, highlighting the availability of PoCs but not active exploitation or mitigation details.
08043302.5K
455 followersView on X
termireum@termireum151d
PoC
Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572) https://github.com/dwisiswant0/next-16.2.4-pocs
Post summary
A GitHub repository containing Proof of Concept exploits for multiple CVEs in Next.js v16.2.4 has been published.
0101810684
758 followersView on X
Huda Al-Assaf@0x0Huda150d
PoC
Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572) https://github.com/dwisiswant0/next-16.2.4-pocs
Post summary
The content announces a GitHub repository containing Proof‑of‑Concept code for multiple Next.js v16.2.4 CVEs, without indicating active exploitation, patches, or detailed technical characteristics.
020543.0K
727 followersView on X
Hacking Team@HackingTeam77151d
PoC
next-16.2.4-pocs Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-445... https://github.com/dwisiswant0/next-16.2.4-pocs #exploit
Post summary
The message announces a GitHub repository with Proof‑of‑Concept code for several Next.js CVEs. It contains no evidence of active exploitation, patches, or technical details.
01000342
1.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vercel	next.js	-	node.js	-

Explore more

Back to dashboard vercel CVEs next.js vulnerabilities

What researchers are saying

CVE-2026-44580

dw1[verified]@dwisiswant0PoC

The text lists multiple CVE identifiers and provides a link to a GitHub repository that presumably hosts proof‑of‑concept code, but it lacks details on patches, active exploitation, or technical specifics.

Nicolas Krassas[verified]@DinosnPoC

A GitHub repository hosts proof‑of‑concept exploit code for several Next.js 16.2.4 CVEs, with no evidence of active exploitation or patch information.

Huda Al-Assaf[verified]@0x0HudaPoC

The content announces a GitHub repository containing Proof‑of‑Concept code for multiple Next.js v16.2.4 CVEs, without indicating active exploitation, patches, or detailed technical characteristics.

Psycho 🎭@Psycho10k_PoC

The post shares a GitHub repository containing proof‑of‑concept code for a collection of Next.js CVEs, highlighting the availability of PoCs but not active exploitation or mitigation details.

termireum@termireumPoC

A GitHub repository containing Proof of Concept exploits for multiple CVEs in Next.js v16.2.4 has been published.

Hacking Team@HackingTeam77PoC

The message announces a GitHub repository with Proof‑of‑Concept code for several Next.js CVEs. It contains no evidence of active exploitation, patches, or technical details.