Next.js vulnerable to cache poisoning in React Server Component responses
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 14.2.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44576 · GHSA-wfc6-r584-vfw7 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
6601–6625 of 30,985 matching · newest first
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 14.2.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44576 · GHSA-wfc6-r584-vfw7 · amended
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 15.2.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44575 · GHSA-267c-6grr-h53f · amended
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 15.4.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44574 · GHSA-492v-c6pp-mqqv · amended
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 12.2.0, < 15.5.16; >= 16.0.0, < 16.2.5 · CVE-2026-44573 · GHSA-36qx-fr4f-26g5 · amended
Go github.com/ellanetworks/core · Upgrade to 1.10.0 or later · < 1.10.0 · CVE-2026-44474 · GHSA-mc29-hmx6-856q
Go github.com/ellanetworks/core · Upgrade to 1.10.0 or later · < 1.10.0 · CVE-2026-44475 · GHSA-pwfh-mqp3-pqwj
Go github.com/ellanetworks/core · Upgrade to 1.10.0 or later · < 1.10.0 · CVE-2026-44473 · GHSA-qfxw-v8qx-vj3v
PyPI python-liquid · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2026-45017 · GHSA-8p4x-wr7x-3788 · amended
PyPI oxidize-pdf · Upgrade to 0.5.0 or later · <= 0.4.3 · +2 more packages · GHSA-88q9-cmp2-c2vq · amended
PyPI urllib3 · Upgrade to 2.7.0 or later · >= 2.6.0, < 2.7.0 · CVE-2026-44432 · GHSA-mf9v-mfxr-j63j · amended
PyPI urllib3 · Upgrade to 2.7.0 or later · >= 1.23, < 2.7.0 · CVE-2026-44431 · GHSA-qccp-gfcp-xxvc · amended
npm @vitejs/plugin-rsc · Upgrade to 0.5.26 or later · <= 0.5.25 · GHSA-w94c-4vhp-22gx · amended
npm next · Upgrade to 16.2.5 or 15.5.16 by release line · >= 13.0.0, < 15.5.16; >= 16.0.0, < 16.2.5 · GHSA-8h8q-6873-q5fj · amended
npm react-server-dom-turbopack +2 · Upgrade all 3 to 19.2.6, 19.1.7 or 19.0.6 by release line · >= 19.0.0, < 19.0.6; >= 19.1.0, < 19.1.7; >= 19.2.0, < 19.2.6 · CVE-2026-23870 · GHSA-rv78-f8rc-xrxh · amended
Go github.com/go-git/go-git/v6 · Upgrade to 6.0.0-alpha.3 (pre-release) or later · >= 6.0.0-alpha.1, <= 6.0.0-alpha.2 · +1 more package · CVE-2026-45022 · GHSA-389r-gv7p-r3rp
PyPI keylime · Upgrade to 7.14.2 or later · >= 7.14.0, <= 7.14.1 · CVE-2026-6420 · GHSA-q8w6-w55c-ccv5 · amended
npm @opentelemetry/exporter-prometheus · Upgrade to 0.217.0 or later · < 0.217.0 · +2 more packages · CVE-2026-44902 · GHSA-q7rr-3cgh-j5r3 · amended
crates.io steamworks · Upgrade to 0.13.1 or later · < 0.13.1 · GHSA-g588-cjg3-6g78
PyPI streamlink · Upgrade to 8.4.0 or later · <= 8.3.0 · CVE-2026-44353 · GHSA-hgqw-6m45-hw5f · amended
PyPI bentoml · Upgrade to 1.4.39 or later · <= 1.4.38 · CVE-2026-44346 · GHSA-w2pm-x38x-jp44 · amended
PyPI bentoml · Upgrade to 1.4.39 or later · <= 1.4.38 · CVE-2026-44345 · GHSA-78f9-r8mh-4xm2 · amended
PyPI open-webui · Upgrade to 0.6.19 or later · < 0.6.19 · CVE-2026-44570 · GHSA-hmjq-crxp-7rjw · amended
PyPI open-webui · Upgrade to 0.8.6 or later · <= 0.8.5 · CVE-2026-44571 · GHSA-jgj3-r8hr-9pjw · amended
PyPI open-webui · Upgrade to 0.6.19 or later · <= 0.6.18 · CVE-2026-44569 · GHSA-jxwr-g6r6-j3fx · amended
PyPI open-webui · Upgrade to 0.6.10 or later · <= 0.6.9 · CVE-2026-44565 · GHSA-j3fw-wc48-29g3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.