NEXT · CVE-2026-94484 · Package
FIX → 16.3.8 · 15.5.27 +2
Next.js apps with a root-level catch-all page alongside statically generated or ISR routes can have their shared response cache poisoned by one unauthenticated crafted request. The sources say this leads to cross-user content substitution and persistent denial of service.
first public Sep 30, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on Next.js that combine a root-level catch-all page with statically generated or ISR routes are exposed, because a single unauthenticated request can poison the shared cache. Apps without that route layout, or whose cache is not shared across users, are less exposed; the sources do not say more. Teams that only run static exports or fully dynamic routes can likely skip it.
Not affected if auth-required, static-export
Who cares next.js, self-hosted, vercel
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
npm ls nextapp/[...slug]/page.tsx or pages/[...slug].tsx) alongside statically generated or ISR routesUpgrade to 16.3.8 · 15.5.27 +2
next 16.3.8 for the 16.x line (affected >= 16.0.0, < 16.3.8)next 15.5.27 for the 15.x line (affected >= 15.0.0, < 15.5.27)GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.