CVE-2026-94543: Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Q: Which deployments are affected?

Affected deployments are self-hosted Next.js applications using the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages. Applications deployed on Vercel are not affected.

Q: What does an attacker need to do to exploit this issue?

An attacker needs to make a request that causes a response cache entry for one route to be replaced with content from a different route. The advisory indicates no privileges or user interaction are required, but exploitation has high attack complexity and requires a particular attack condition.

Q: What is the impact if exploitation succeeds?

An affected page can serve incorrect content from another route to every visitor until the cached entry is revalidated. The supplied CVSS vector indicates an availability impact limited to the vulnerable component, with no stated confidentiality or integrity impact.

Q: What should teams do to remediate the issue?

Upgrade affected Next.js 15 deployments to 15.5.27 or affected Next.js 16 deployments to 16.3.8. The provided information does not specify a workaround for teams that cannot upgrade immediately.

Published Oct 2, 2026

Updated

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.

Affected Software

1 affected component

Vercel Next.js>=15.0.0<15.5.27, >=16.0.0<16.3.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Next.js to a version that resolves this vulnerability.
Fixed in 15.5.27
Upgrade
Upgrade Next.js to a version that resolves this vulnerability.
Fixed in 16.3.8

Event History

Oct 2, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected deployments are self-hosted Next.js applications using the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages. Applications deployed on Vercel are not affected.

What does an attacker need to do to exploit this issue?

An attacker needs to make a request that causes a response cache entry for one route to be replaced with content from a different route. The advisory indicates no privileges or user interaction are required, but exploitation has high attack complexity and requires a particular attack condition.

What is the impact if exploitation succeeds?

An affected page can serve incorrect content from another route to every visitor until the cached entry is revalidated. The supplied CVSS vector indicates an availability impact limited to the vulnerable component, with no stated confidentiality or integrity impact.

What should teams do to remediate the issue?

Upgrade affected Next.js 15 deployments to 15.5.27 or affected Next.js 16 deployments to 16.3.8. The provided information does not specify a workaround for teams that cannot upgrade immediately.

CVE-2026-94543: Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to do to exploit this issue?

What is the impact if exploitation succeeds?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to do to exploit this issue?

What is the impact if exploitation succeeds?

What should teams do to remediate the issue?