Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Next.js Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-44580 - Vulnerability Database
Next.js

Next.js Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-44580

Medium
Reference: CVE-2026-44580
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-44580
Title: Next.js Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5 applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions serialized script content was not escaped safely before being embedded into the document which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor39s browser. This vulnerability is fixed in 15.5.16 and 16.2.5.