CVE-2026-94544: Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the regular request prerenders a page, the draft-dependent content can persist in the generated page and be served to later visitors until revalidation. Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed in version 16.3.8.
Other sources
Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill:
- A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication. - A Draft Mode request that overlaps a regular request receives published content instead of the draft.
If the overlapping regular request prerenders a page — for example an on-demand prerender of a route that was not prerendered at build time — the unpublished content can be persisted into the generated page and served to all later visitors of that route until the page is revalidated. Since cached functions can be shared across routes, the poisoned page does not need to be the page the editor is previewing.
Sites are affected if they enable Cache Components (or experimental.useCache) and serve Draft Mode previews whose cached functions return draft-dependent content.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.3.8 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.3.8
Event History
Frequently Asked Questions
Which deployments are affected?
Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return content that depends on Draft Mode. The issue affects Next.js versions from 16.3.0 through 16.3.7.
What conditions are required for content exposure?
A Draft Mode request and a regular request must overlap while filling the same pending use cache key. A regular request can then receive unauthenticated unpublished content from the editor's Draft Mode fill.
Can the exposure persist after the overlapping requests finish?
Yes. If the regular request prerenders a page, draft-dependent content can be persisted in the generated page and served to later visitors until revalidation.
What should teams do?
Upgrade to Next.js 16.3.8, which fixes the issue. If immediate patching is not possible, avoid caching functions that return Draft Mode-dependent content where Cache Components or experimental.useCache is enabled.