Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

next package could allow unauthorized code execution

CVE-2026-44573 · published 2 days ago
Summary

The JavaScript framework next, used in GitHub Actions and other builds, has a flaw that could let an attacker run code on your system. This could compromise your applications or data. Update to the latest patched versions of the next package as soon as possible.

What to do
  • Update GitHub Actions next to version 16.2.5-aikido.1.
  • Update GitHub Actions next to version 15.5.16.
  • Update GitHub Actions next to version 16.2.5.
  • Update rootio @rootio/next to version 16.1.6-root.io.4.
  • Update GitHub Actions next to version 16.1.6-aikido.4.
  • Update GitHub Actions next to version 16.1.7-aikido.1.
  • Update rootio @rootio/next to version 16.1.7-root.io.1.
  • Update GitHub Actions next to version 16.1.6-aikido.5.
  • Update rootio @rootio/next to version 16.1.6-root.io.5.
  • Update GitHub Actions next to version 15.5.15-aikido.2.
  • Update rootio @rootio/next to version 15.5.15-root.io.2.
  • Update rootio @rootio/next to version 16.2.5-root.io.1.
  • Update next to version 16.2.5-aikido.2.
  • Update rootio @rootio/next.js to version 15.5.10-root.io.1.
  • Update next.js to version 15.5.10-aikido.1.
  • Update rootio @rootio/next.js to version 15.5.10-root.io.2.
  • Update next.js to version 15.5.10-aikido.2.
  • Update rootio @rootio/next to version 16.2.5-root.io.2.
  • Update GitHub Actions next to version 16.2.5-aikido.2.
Affected software
Ecosystem VendorProductAffected versions
Root:npm GitHub Actions next < 16.2.5-aikido.1
< 16.1.6-aikido.4
< 16.1.7-aikido.1
< 16.1.6-aikido.5
< 15.5.15-aikido.2
< 16.2.5-aikido.2
Fix: upgrade to 16.2.5-aikido.1
npm GitHub Actions next >= 12.2.0, < 15.5.16
>= 16.0.0, < 16.2.5
Fix: upgrade to 15.5.16
Root:npm rootio @rootio/next < 16.1.6-root.io.4
< 16.1.7-root.io.1
< 16.1.6-root.io.5
< 15.5.15-root.io.2
< 16.2.5-root.io.1
< 16.2.5-root.io.2
Fix: upgrade to 16.1.6-root.io.4
Root:npm – next < 16.2.5-aikido.2
Fix: upgrade to 16.2.5-aikido.2
– vercel next.js >= 12.2.0, < 15.5.16
>= 16.0.0, < 16.2.5
Root:npm rootio @rootio/next.js < 15.5.10-root.io.1
< 15.5.10-root.io.2
Fix: upgrade to 15.5.10-root.io.1
Root:npm – next.js < 15.5.10-aikido.1
< 15.5.10-aikido.2
Fix: upgrade to 15.5.10-aikido.1
Original advisory text
CVE-2026-44573 in next - Patched by Root
Root has patched CVE-2026-44573 in the next package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Timeline
Published2 Nov 2026
Updated4 Nov 2026
First seen11 May 2026
Sources
ROOT-APP-NPM-CVE-2026-44573 · OSV
GHSA-36qx-fr4f-26g5 · GHSA
CVE-2026-44573 · NVD
CVE-2026-44573 · MITRE
CVE-2026-44573 · OSV
Track software like this
Free during beta