Next.js CVE-2026-44580

Upgrade Next.js to version 15.5.16 or later for the 15.x branch, or version 16.2.5 or later for the 16.x branch. These versions implement HTML-escaping of serialized beforeInteractive script content, preventing attacker-controlled input from breaking out of the script boundary. The upgrade can be performed via npm update next or by modifying package.json and reinstalling dependencies. If immediate upgrade is not feasible, implement the following compensating controls with noted trade-offs: (1) Do not pass untrusted data (user input, database-sourced content, or API responses) directly into beforeInteractive script features - this is the primary mitigation and involves code review of all beforeInteractive usage; (2) If passing dynamic content to beforeInteractive is unavoidable, manually HTML-escape all untrusted input using libraries like he or xss before embedding, though this shifts responsibility to developers and increases risk of escape failures; (3) Implement Content Security Policy (CSP) with script-src restrictions to limit the impact of successfully injected scripts, though CSP does not prevent inline script execution without nonce or hash whitelisting, which Next.js may not support for dynamically-generated beforeInteractive scripts. Vercel recommends immediate patching as the primary remediation path.