NEXT · CVE-2026-94544 · Runtime
FIX → 16.3.8 +1
Next.js shares pending `use cache` fills across requests with the same key without checking whether a request is in Draft Mode. A regular visitor overlapping an editor's preview can receive unpublished draft content, and that content can be saved into a statically generated page served to later visitors.
first public Sep 30, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites that enable Cache Components or experimental.useCache and serve Draft Mode previews where cached functions return draft-dependent content. Because cached functions can be shared across routes, the poisoned page need not be the one being previewed. Sites without these features enabled are not affected per the advisory's description.
Not affected if cache-components-disabled, no-draft-mode, static-export
Who cares cache-components, draft-mode, next.js, self-hosted
npx next --version or node -p "require('next/package.json').version".cacheComponents or enabled in or .Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill:
If the overlapping regular request prerenders a page — for example an on-demand prerender of a route that was not prerendered at build time — the unpublished content can be persisted into the generated page and served to all later visitors of that route until the page is revalidated. Since cached functions can be shared across routes, the poisoned page does not need to be the page the editor is previewing.
Sites are affected if they enable Cache Components (or experimental.useCache) and serve Draft Mode previews whose cached functions return draft-dependent content.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
experimental.useCachenext.config.jsnext.config.tsdraftMode()) is used with cached functions that return draft-dependent content.Upgrade to 16.3.8 +1
16.3.8GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.