{"id":"CVE-2026-94484","kind":"vulnerability","aliases":["CVE-2026-94484","GHSA-mcj8-r9mp-w47p"],"related":[],"title":"Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service","description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","summary":"Next.js apps with a root-level catch-all page alongside statically generated or ISR routes can have their shared response cache poisoned by one unauthenticated crafted request. The sources say this leads to cross-user content substitution and persistent denial of service.","severity":"medium","cvss":6.3,"epss":0.00244,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.3.?"],"affected":">= 16.0.0","ecosystem":"npm"},{"name":"next","fixed":["15.5.?"],"affected":">= 15.0.0","ecosystem":"npm"},{"name":"next","fixed":["16.3.8"],"affected":">= 16.0.0, < 16.3.8","ecosystem":"npm"},{"name":"next","fixed":["15.5.27"],"affected":">= 15.0.0, < 15.5.27","ecosystem":"npm"},{"name":"vercel next.js","fixed":["15.5.27"],"affected":">= 15.0.0, < 15.5.27","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["16.3.8"],"affected":">= 16.0.0, < 16.3.8","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-524","next.js","package","self-hosted","vercel"],"not_affected_if":["auth-required","static-export"],"how_to_check":"- Check the installed version with `npm ls next`\n- Look for a root-level catch-all page (for example `app/[...slug]/page.tsx` or `pages/[...slug].tsx`) alongside statically generated or ISR routes","fix":"- `next` `16.3.8` for the 16.x line (affected >= 16.0.0, < 16.3.8)\n- `next` `15.5.27` for the 15.x line (affected >= 15.0.0, < 15.5.27)","status":"open","published_at":"2026-09-30T16:14:19+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","triaged_at":"2026-11-09T23:00:57+00:00","updated_at":"2026-11-09T23:10:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T23:00:57Z","model":"claude-haiku-5-5","output":{"fix":"- `next` `16.3.8` for the 16.x line (affected >= 16.0.0, < 16.3.8)\n- `next` `15.5.27` for the 15.x line (affected >= 15.0.0, < 15.5.27)","reach":"internet","title":"Next.js: cache poisoning in static rendering serves one user's page to others","impact":"medium","summary":"Next.js apps with a root-level catch-all page alongside statically generated or ISR routes can have their shared response cache poisoned by one unauthenticated crafted request. The sources say this leads to cross-user content substitution and persistent denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["next.js","self-hosted","vercel"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Users receive other users' content; the cache serves errors persistently.","analyst_note":"","how_to_check":"- Check the installed version with `npm ls next`\n- Look for a root-level catch-all page (for example `app/[...slug]/page.tsx` or `pages/[...slug].tsx`) alongside statically generated or ISR routes\n- unknown whether other configurations are affected","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["static-export","auth-required"],"who_is_affected":"Applications built on Next.js that combine a root-level catch-all page with statically generated or ISR routes are exposed, because a single unauthenticated request can poison the shared cache. Apps without that route layout, or whose cache is not shared across users, are less exposed; the sources do not say more. Teams that only run static exports or fully dynamic routes can likely skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000797,"input_tokens":4835,"output_tokens":627,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':22A,30A '-524':41B '-94484':23A,31A '15.0.0':106C '15.5.27':108C,178C '16.3.8':110C,180C 'alongsid':59B 'app':49B 'applic':104C,111C 'build':99C 'cach':3A,70B,134C,152C 'catch':56B,118C 'catch-al':55B,117C 'caus':153C 'content':14A,86B,157C 'craft':75B,147C 'cross':12A,84B,155C 'cross-us':11A,83B,154C 'cve':21A,29A 'cwe':40B 'denial':18A,90B,161C 'entri':167C 'fix':175C 'framework':97C 'full':101C 'full-stack':100C 'generat':61B,123C 'ghsa':25A 'ghsa-mcj8-r9mp-w47p':24A 'host':46B 'increment':125C 'insuffici':138C 'isr':63B 'issu':173C 'key':135C 'lead':9A,81B 'level':54B,116C 'mcj8':26A 'next':32A,33A,34A,35A 'next.js':1A,37A,39A,42B,48B,93C 'one':73B 'packag':43B 'page':58B,120C 'persist':17A,89B,160C 'poison':4A,71B,150C,166C 'r9mp':27A 'react':96C 'regener':127C 'render':7A 'replac':171C 'request':76B,148C 'respons':69B,133C 'revalid':169C 'root':53B,115C 'root-level':52B,114C 'rout':64B,128C,143C 'say':79B 'scope':139C 'self':45B 'self-host':44B 'servic':20A,92B,163C 'share':68B,132C 'singl':145C 'sourc':78B,142C 'ssg/isr':6A 'stack':102C 'static':60B,122C,126C 'substitut':15A,87B,158C 'unauthent':74B,146C 'use':130C 'user':13A,85B,156C 'vercel':36A,38A,47B 'version':177C 'w47p':28A 'web':103C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Next.js that combine a root-level catch-all page with statically generated or ISR routes are exposed, because a single unauthenticated request can poison the shared cache. Apps without that route layout, or whose cache is not shared across users, are less exposed; the sources do not say more. Teams that only run static exports or fully dynamic routes can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["next","nextjs","vercelnextjs"],"ptokens":["next","nextjs","vercel"],"labels":["cwe524","medium","nextjs","npm","package","selfhosted","vendor","vercel"],"campaign_type":null,"search_a":"'-2026':22A,30A '-94484':23A,31A 'cach':3A 'content':14A 'cross':12A 'cross-us':11A 'cve':21A,29A 'denial':18A 'ghsa':25A 'ghsa-mcj8-r9mp-w47p':24A 'lead':9A 'mcj8':26A 'next':32A,33A,34A,35A 'next.js':1A,37A,39A 'persist':17A 'poison':4A 'r9mp':27A 'render':7A 'servic':20A 'ssg/isr':6A 'substitut':15A 'user':13A 'vercel':36A,38A 'w47p':28A","search_b":"'-524':41B 'alongsid':59B 'app':49B 'cach':70B 'catch':56B 'catch-al':55B 'content':86B 'craft':75B 'cross':84B 'cross-us':83B 'cwe':40B 'denial':90B 'generat':61B 'host':46B 'isr':63B 'lead':81B 'level':54B 'next.js':42B,48B 'one':73B 'packag':43B 'page':58B 'persist':89B 'poison':71B 'request':76B 'respons':69B 'root':53B 'root-level':52B 'rout':64B 'say':79B 'self':45B 'self-host':44B 'servic':92B 'share':68B 'sourc':78B 'static':60B 'substitut':87B 'unauthent':74B 'user':85B 'vercel':47B","search_c":"'15.0.0':106C '15.5.27':108C,178C '16.3.8':110C,180C 'applic':104C,111C 'build':99C 'cach':134C,152C 'catch':118C 'catch-al':117C 'caus':153C 'content':157C 'craft':147C 'cross':155C 'cross-us':154C 'denial':161C 'entri':167C 'fix':175C 'framework':97C 'full':101C 'full-stack':100C 'generat':123C 'increment':125C 'insuffici':138C 'issu':173C 'key':135C 'level':116C 'next.js':93C 'page':120C 'persist':160C 'poison':150C,166C 'react':96C 'regener':127C 'replac':171C 'request':148C 'respons':133C 'revalid':169C 'root':115C 'root-level':114C 'rout':128C,143C 'scope':139C 'servic':163C 'share':132C 'singl':145C 'sourc':142C 'stack':102C 'static':122C,126C 'substitut':158C 'unauthent':146C 'use':130C 'user':156C 'version':177C 'web':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-30T16:14:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-mcj8-r9mp-w47p","url":"https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p","severity":"medium","published_at":"2026-09-30T16:14:19+00:00","modified_at":"2026-09-30T16:14:19+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","fetched_at":"2026-11-09T22:53:14+00:00","note":null},{"source":"ghsa","external_id":"GHSA-mcj8-r9mp-w47p","url":"https://github.com/advisories/GHSA-mcj8-r9mp-w47p","severity":"medium","published_at":"2026-10-07T20:31:13+00:00","modified_at":"2026-10-07T20:31:15+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94484","severity":null,"published_at":"2026-10-02T16:16:51+00:00","modified_at":"2026-10-05T20:17:28+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110405,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-30T16:14:19+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110775,"url":"https://api.github.com/repos/vercel/next.js/security-advisories/GHSA-mcj8-r9mp-w47p","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":43067,"url":"https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":43068,"url":"https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":43069,"url":"https://github.com/vercel/next.js/releases/tag/v15.5.27","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":43051,"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00244,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94484"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}