Live › vulnerability › CVE-2026-94543
Go to dashboardNext.js, a React framework for full-stack web apps, has a cache poisoning flaw tracked as CVE-2026-94543. The sources describe it only as cache poisoning, so an attacker may be able to make cached responses carry malicious content to other visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 17:18 UTC, 0h before NVD. All times on this page are UTC.
Teams running Next.js 15.0.0 before 15.5.27 or Next.js 16.0.0 before 16.3.8 are in the affected range. The sources do not say which deployment modes, caching setups or routes make an app exposed, so unknown. Apps already on the fixed versions are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vercel next.js | vendor | >= 15.0.0, < 15.5.27 | 15.5.27 |
| vercel next.js | vendor | >= 16.0.0, < 16.3.8 | 16.3.8 |
npx next --version in the project and compare against the fixed versions 15.5.27 and 16.3.8.next entry in package.json and the lockfile for the resolved version.15.5.27 or later.16.3.8 or later.What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-10-06 · Changelog
New updates and improvements at Cloudflare.
October 6, 2026
This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...a056caff | N/A | Command Injection - Generic 8 - uri - Beta | Log | Block | This rule is merged into the original rule "Command Injection - Generic 8 - uri" (ID: ...ee159e2e). |
| Cloudflare Managed Ruleset | ...7206c737 | N/A | F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...549f7356 | N/A | Next.js - Cache Poisoning - CVE:CVE-2026-94543 | Block | Block | Rule metadata description refined. Detection unchanged. |
This page as .md · .json · in your agent: get_signal("CVE-2026-94543")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.