CVE-2026-94484: Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Q: Which applications are exposed?

Applications using Next.js versions from 15.0.0 before the fixed releases are affected when they have both a root-level catch-all page and statically generated or Incremental Static Regeneration routes.

Q: Does exploitation require an authenticated user?

No. A single unauthenticated crafted request can poison the shared response cache.

Q: What can happen after the cache is poisoned?

Users may receive content belonging to a different route or user context, or the poisoned cache entry can cause persistent denial of service. The condition remains until the entry is revalidated or replaced.

Q: What should teams do if they cannot patch immediately?

Revalidate or replace poisoned cache entries to clear an existing condition. Upgrade to Next.js 15.5.27 or 16.3.8 as the permanent fix.

Published Oct 2, 2026

Updated

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.

Affected Software

1 affected component

Vercel Next.js>=15.0.0<15.5.27, >=16.0.0<16.3.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Next.js to a version that resolves this vulnerability.
Fixed in 15.5.27
Upgrade
Upgrade Next.js to a version that resolves this vulnerability.
Fixed in 16.3.8

Event History

Oct 2, 2026

CVE Published

via MITRE·03:26 PM

Data Sourced

via MITRE·03:26 PM

DescriptionWeakness

Frequently Asked Questions

Which applications are exposed?

Applications using Next.js versions from 15.0.0 before the fixed releases are affected when they have both a root-level catch-all page and statically generated or Incremental Static Regeneration routes.

Does exploitation require an authenticated user?

No. A single unauthenticated crafted request can poison the shared response cache.

What can happen after the cache is poisoned?

Users may receive content belonging to a different route or user context, or the poisoned cache entry can cause persistent denial of service. The condition remains until the entry is revalidated or replaced.

What should teams do if they cannot patch immediately?

Revalidate or replace poisoned cache entries to clear an existing condition. Upgrade to Next.js 15.5.27 or 16.3.8 as the permanent fix.

CVE-2026-94484: Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed?

Does exploitation require an authenticated user?

What can happen after the cache is poisoned?

What should teams do if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed?

Does exploitation require an authenticated user?

What can happen after the cache is poisoned?

What should teams do if they cannot patch immediately?