CVE-2026-94543: Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.
Other sources
Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.3.8 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.27 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.5.27 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.3.8
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are self-hosted Next.js applications using the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages. Applications deployed on Vercel are not affected.
What does an attacker need to do to exploit this issue?
An attacker needs to make a request that causes a response cache entry for one route to be replaced with content from a different route. The advisory indicates no privileges or user interaction are required, but exploitation has high attack complexity and requires a particular attack condition.
What is the impact if exploitation succeeds?
An affected page can serve incorrect content from another route to every visitor until the cached entry is revalidated. The supplied CVSS vector indicates an availability impact limited to the vulnerable component, with no stated confidentiality or integrity impact.
What should teams do to remediate the issue?
Upgrade affected Next.js 15 deployments to 15.5.27 or affected Next.js 16 deployments to 16.3.8. The provided information does not specify a workaround for teams that cannot upgrade immediately.