CVE-2026-94484: Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.
Other sources
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.27 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.3.8 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.5.27 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.3.8
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using Next.js versions from 15.0.0 before the fixed releases are affected when they have both a root-level catch-all page and statically generated or Incremental Static Regeneration routes.
Does exploitation require an authenticated user?
No. A single unauthenticated crafted request can poison the shared response cache.
What can happen after the cache is poisoned?
Users may receive content belonging to a different route or user context, or the poisoned cache entry can cause persistent denial of service. The condition remains until the entry is revalidated or replaced.
What should teams do if they cannot patch immediately?
Revalidate or replace poisoned cache entries to clear an existing condition. Upgrade to Next.js 15.5.27 or 16.3.8 as the permanent fix.