{"id":"CVE-2026-94543","kind":"vulnerability","aliases":["CVE-2026-94543"],"related":[],"title":"Next.js: cache poisoning flaw can serve attacker content to other users","description":"WAF Release - 2026-10-06 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 6, 2026\n\n## WAF Release - 2026-10-06\n\nThis release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.\n\nKey Findings\n\n- CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP. Attackers can exploit this flaw to execute arbitrary code on the affected system.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...a056caff | N/A | Command Injection - Generic 8 - uri - Beta | Log | Block | This rule is merged into the original rule \"Command Injection - Generic 8 - uri\" (ID: ...ee159e2e). |\n| Cloudflare Managed Ruleset | ...7206c737 | N/A | F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...549f7356 | N/A | Next.js - Cache Poisoning - CVE:CVE-2026-94543 | Block | Block | Rule metadata description refined. Detection unchanged. |","summary":"Next.js, a React framework for full-stack web apps, has a cache poisoning flaw tracked as CVE-2026-94543. The sources describe it only as cache poisoning, so an attacker may be able to make cached responses carry malicious content to other visitors.","severity":"medium","cvss":6.3,"epss":0.00288,"exploited":false,"exploited_at":null,"products":[{"name":"vercel next.js","fixed":["15.5.27"],"affected":">= 15.0.0, < 15.5.27","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["16.3.8"],"affected":">= 16.0.0, < 16.3.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","lab-disclosure","next.js","runtime","self-hosted"],"not_affected_if":[],"how_to_check":"- Run `npx next --version` in the project and compare against the fixed versions `15.5.27` and `16.3.8`.\n- Check the `next` entry in `package.json` and the lockfile for the resolved version.\n- Confirm whether the app serves cached pages or responses through a CDN or cache layer.","fix":"- Upgrade Next.js 15.x to `15.5.27` or later.\n- Upgrade Next.js 16.x to `16.3.8` or later.\n- Redeploy and clear any CDN or edge cache that stored responses from an affected version.","status":"open","published_at":"2026-10-02T16:16:52+00:00","first_seen_at":"2026-10-24T17:18:15+00:00","triaged_at":"2026-10-25T04:02:03+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:02:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Next.js 15.x to `15.5.27` or later.\n- Upgrade Next.js 16.x to `16.3.8` or later.\n- Redeploy and clear any CDN or edge cache that stored responses from an affected version.","reach":"unknown","title":"Next.js: cache poisoning flaw can serve attacker content to other users","impact":"medium","summary":"Next.js, a React framework for full-stack web apps, has a cache poisoning flaw tracked as CVE-2026-94543. The sources describe it only as cache poisoning, so an attacker may be able to make cached responses carry malicious content to other visitors.","category":"runtime","nicknames":[],"who_cares":["next.js","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may poison cached responses served to other users","analyst_note":"Sources are only a Cloudflare WAF changelog and the NVD entry; find the Vercel or Next.js GHSA advisory for the exact cache-poisoning mechanism, affected deployment modes, and whether a workaround exists.","how_to_check":"- Run `npx next --version` in the project and compare against the fixed versions `15.5.27` and `16.3.8`.\n- Check the `next` entry in `package.json` and the lockfile for the resolved version.\n- Confirm whether the app serves cached pages or responses through a CDN or cache layer.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Next.js 15.0.0 before 15.5.27 or Next.js 16.0.0 before 16.3.8 are in the affected range. The sources do not say which deployment modes, caching setups or routes make an app exposed, so unknown. Apps already on the fixed versions are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001026,"input_tokens":3891,"output_tokens":1274,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-06':79C,95C '-10':78C,94C '-2026':13A,16A,49B,134C,216C,235C '-94127':135C,217C '-94543':14A,17A,50B,236C '2026':77C,90C,93C '549f7356':228C '6':89C '7206c737':204C '8':181C,197C 'a056caff':176C 'abl':64B 'action':169C,171C 'affect':159C 'app':40B 'arbitrari':155C 'attack':7A,61B,148C 'base':107C,139C 'baselin':129C 'beta':125C,183C 'big':114C,146C,208C 'big-ip':113C,145C,207C 'block':185C,219C,237C,238C 'buffer':108C,140C 'cach':2A,43B,57B,67B,231C 'carri':69B 'changelog':80C,81C 'cloudflar':22B,87C,173C,201C,225C 'code':156C 'command':119C,178C,194C 'comment':172C 'content':8A,71B 'cve':12A,15A,48B,133C,214C,215C,233C,234C 'describ':53B 'descript':167C,241C 'detect':101C,224C,243C 'disclosur':25B 'ee159e2e':200C 'enhanc':117C 'execut':154C 'exist':118C 'exploit':150C 'f5':112C,144C,206C 'find':132C 'flaw':4A,45B,152C 'framework':34B 'full':37B 'full-stack':36B 'generic':180C,196C 'heap':106C,138C,212C 'heap-bas':105C,137C 'heap-overflow':211C 'host':30B 'id':163C,166C,199C 'improv':85C 'incorpor':123C 'inject':120C,179C,195C 'introduc':98C 'ip':115C,147C,209C 'key':131C 'lab':24B 'lab-disclosur':23B 'legaci':164C 'log':184C,218C 'logic':126C 'make':66B 'malici':70B 'manag':174C,202C,226C 'may':62B 'merg':189C 'metadata':240C 'mitig':103C 'n/a':177C,205C,229C 'new':82C,100C,170C,223C 'next.js':1A,19A,21A,26B,31B,230C 'octob':88C 'origin':192C 'overflow':109C,141C,213C 'poison':3A,44B,58B,232C 'previous':168C 'protect':121C 'react':33B 'refin':242C 'releas':76C,92C,97C 'respons':68B 'rule':130C,162C,165C,187C,193C,239C 'ruleset':161C,175C,203C,227C 'runtim':27B 'self':29B 'self-host':28B 'serv':6A 'sourc':52B 'stack':38B 'system':160C 'test':124C 'track':46B 'unauth':210C 'unchang':244C 'updat':83C 'uri':182C,198C 'user':11A 'vercel':18A,20A 'visitor':74B 'vulner':110C,142C 'waf':75C,91C 'web':39B","nicknames":[],"mitigations":[{"kind":"waf-rule","since":null,"covers":"HTTP requests proxied through Cloudflare that match the Next.js cache poisoning exploit (Cloudflare Managed Ruleset rule ...549f7356, action Block)","limits":"none stated; the document says only the rule metadata description was refined and detection is unchanged","source":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:20Z","confidence":0.8,"source_title":"Cloudflare: WAF Release - 2026-10-06 · Changelog","customer_action":"none stated"}],"who_affected":"Teams running Next.js 15.0.0 before 15.5.27 or Next.js 16.0.0 before 16.3.8 are in the affected range. The sources do not say which deployment modes, caching setups or routes make an app exposed, so unknown. Apps already on the fixed versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-02T16:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/#CVE-2026-94543","url":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/","severity":null,"published_at":"2026-10-06T17:17:59+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-10-06 · Changelog"},{"source":"nvd","external_id":"CVE-2026-94543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94543","severity":null,"published_at":"2026-10-02T16:16:52+00:00","modified_at":"2026-10-06T17:17:27+00:00","first_seen_at":"2026-10-24T17:18:50+00:00","fetched_at":"2026-10-24T17:18:50+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94543","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94543","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2842,"url":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/","title":"Cloudflare: WAF Release - 2026-10-06 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-10-06 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 6, 2026\n\n## WAF Release - 2026-10-06\n\nThis release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.\n\nKey Findings\n\n- CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP. Attackers can exploit this flaw to execute arbitrary code on the affected system.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...a056caff | N/A | Command Injection - Generic 8 - uri - Beta | Log | Block | This rule is merged into the original rule \"Command Injection - Generic 8 - uri\" (ID: ...ee159e2e). |\n| Cloudflare Managed Ruleset | ...7206c737 | N/A | F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...549f7356 | N/A | Next.js - Cache Poisoning - CVE:CVE-2026-94543 | Block | Block | Rule metadata description refined. Detection unchanged. |","published_at":"2026-10-06T17:17:59+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}