{"id":"CVE-2026-94544","kind":"vulnerability","aliases":["CVE-2026-94544","GHSA-3w37-wq28-93x7"],"related":[],"title":"Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages","description":"<!-- https://linear.app/vercel/issue/NSEC-352 -->\r\n\r\nPending `use cache` fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill:\r\n\r\n- A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication.\r\n- A Draft Mode request that overlaps a regular request receives published content instead of the draft.\r\n\r\nIf the overlapping regular request prerenders a page — for example an on-demand prerender of a route that was not prerendered at build time — the unpublished content can be persisted into the generated page and served to all later visitors of that route until the page is revalidated. Since cached functions can be shared across routes, the poisoned page does not need to be the page the editor is previewing.\r\n\r\nSites are affected if they enable Cache Components (or `experimental.useCache`) and serve Draft Mode previews whose cached functions return draft-dependent content.","summary":"Next.js shares pending `use cache` fills across requests with the same key without checking whether a request is in Draft Mode. A regular visitor overlapping an editor's preview can receive unpublished draft content, and that content can be saved into a statically generated page served to later visitors.","severity":"medium","cvss":6.3,"epss":0.00179,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.3.?"],"affected":"= 16.3.0","ecosystem":"npm"},{"name":"next","fixed":["16.3.8"],"affected":">= 16.3.0, < 16.3.8","ecosystem":"npm"},{"name":"vercel next.js","fixed":["16.3.8"],"affected":">= 16.3.0, < 16.3.8","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cache-components","cwe-524","draft-mode","next.js","runtime","self-hosted"],"not_affected_if":["cache-components-disabled","no-draft-mode","static-export"],"how_to_check":"- Check the installed Next.js version with `npx next --version` or `node -p \"require('next/package.json').version\"`.\n- Look for `cacheComponents` or `experimental.useCache` enabled in `next.config.js` or `next.config.ts`.\n- Check whether Draft Mode (`draftMode()`) is used with cached functions that return draft-dependent content.","fix":"- next: `16.3.8`","status":"open","published_at":"2026-09-30T16:14:35+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","triaged_at":"2026-11-09T23:00:58+00:00","updated_at":"2026-11-09T23:10:12+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T23:00:58Z","model":"claude-haiku-5-5","output":{"fix":"- next: `16.3.8`","reach":"internet","title":"Next.js: pending cache fills can leak Draft Mode content to public visitors","impact":"medium","summary":"Next.js shares pending `use cache` fills across requests with the same key without checking whether a request is in Draft Mode. A regular visitor overlapping an editor's preview can receive unpublished draft content, and that content can be saved into a statically generated page served to later visitors.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["next.js","self-hosted","draft-mode","cache-components"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unpublished draft content is served to public visitors","analyst_note":"","how_to_check":"- Check the installed Next.js version with `npx next --version` or `node -p \"require('next/package.json').version\"`.\n- Look for `cacheComponents` or `experimental.useCache` enabled in `next.config.js` or `next.config.ts`.\n- Check whether Draft Mode (`draftMode()`) is used with cached functions that return draft-dependent content.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["cache-components-disabled","no-draft-mode","static-export"],"who_is_affected":"Sites that enable Cache Components or `experimental.useCache` and serve Draft Mode previews where cached functions return draft-dependent content. Because cached functions can be shared across routes, the poisoned page need not be the one being previewed. Sites without these features enabled are not affected per the advisory's description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000795,"input_tokens":4967,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,26A '-524':36B '-94544':19A,27A '3w37':22A '93x7':24A 'across':51B,100C,216C 'affect':234C 'authent':144C 'build':184C 'cach':4A,33B,49B,96C,211C,238C,248C 'cache-compon':32B 'check':58B 'compon':34B,239C 'content':10A,78B,81B,141C,156C,188C,254C 'cve':17A,25A 'cwe':35B 'demand':174C 'depend':253C 'distinguish':107C 'draft':8A,38B,64B,77B,108C,136C,146C,160C,244C,252C 'draft-depend':251C 'draft-mod':37B 'editor':71B,134C,229C 'enabl':237C 'exampl':170C 'experimental.usecache':241C 'fill':5A,50B,97C,127C 'first':124C 'function':212C,249C 'generat':88B,194C 'ghsa':21A 'ghsa-3w37-wq28-93x7':20A 'host':44B 'instead':157C 'key':56B,105C 'later':92B,200C 'leak':7A 'mode':9A,39B,65B,109C,137C,147C,245C 'need':223C 'next':28A,29A 'next.js':1A,31A,40B,45B 'on-demand':172C 'overlap':69B,118C,132C,150C,163C 'page':16A,89B,168C,195C,207C,220C,227C 'pend':2A,47B,94C 'persist':15A,191C 'poison':219C 'prerend':166C,175C,182C 'preview':73B,231C,246C 'publish':155C 'receiv':75B,122C,139C,154C 'regular':12A,67B,112C,129C,152C,164C 'request':52B,61B,101C,110C,113C,117C,121C,125C,130C,138C,148C,153C,165C 'respons':13A 'return':250C 'revalid':209C 'rout':178C,204C,217C 'runtim':41B 'save':84B 'second':120C 'self':43B 'self-host':42B 'serv':90B,197C,243C 'share':46B,99C,215C 'sinc':210C 'site':232C 'static':87B 'time':185C 'two':115C 'unpublish':76B,140C,187C 'use':3A,48B,95C 'vercel':30A 'visitor':68B,93B,201C 'whether':59B 'whose':247C 'without':57B,106C,142C 'wq28':23A","nicknames":[],"mitigations":[],"who_affected":"Sites that enable Cache Components or `experimental.useCache` and serve Draft Mode previews where cached functions return draft-dependent content. Because cached functions can be shared across routes, the poisoned page need not be the one being previewed. Sites without these features enabled are not affected per the advisory's description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["next","nextjs","vercelnextjs"],"ptokens":["next","nextjs","vercel"],"labels":["cachecomponents","cwe524","draftmode","medium","nextjs","npm","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':18A,26A '-94544':19A,27A '3w37':22A '93x7':24A 'cach':4A 'content':10A 'cve':17A,25A 'draft':8A 'fill':5A 'ghsa':21A 'ghsa-3w37-wq28-93x7':20A 'leak':7A 'mode':9A 'next':28A,29A 'next.js':1A,31A 'page':16A 'pend':2A 'persist':15A 'regular':12A 'respons':13A 'use':3A 'vercel':30A 'wq28':23A","search_b":"'-524':36B 'across':51B 'cach':33B,49B 'cache-compon':32B 'check':58B 'compon':34B 'content':78B,81B 'cwe':35B 'draft':38B,64B,77B 'draft-mod':37B 'editor':71B 'fill':50B 'generat':88B 'host':44B 'key':56B 'later':92B 'mode':39B,65B 'next.js':40B,45B 'overlap':69B 'page':89B 'pend':47B 'preview':73B 'receiv':75B 'regular':67B 'request':52B,61B 'runtim':41B 'save':84B 'self':43B 'self-host':42B 'serv':90B 'share':46B 'static':87B 'unpublish':76B 'use':48B 'visitor':68B,93B 'whether':59B 'without':57B","search_c":"'across':100C,216C 'affect':234C 'authent':144C 'build':184C 'cach':96C,211C,238C,248C 'compon':239C 'content':141C,156C,188C,254C 'demand':174C 'depend':253C 'distinguish':107C 'draft':108C,136C,146C,160C,244C,252C 'draft-depend':251C 'editor':134C,229C 'enabl':237C 'exampl':170C 'experimental.usecache':241C 'fill':97C,127C 'first':124C 'function':212C,249C 'generat':194C 'instead':157C 'key':105C 'later':200C 'mode':109C,137C,147C,245C 'need':223C 'on-demand':172C 'overlap':118C,132C,150C,163C 'page':168C,195C,207C,220C,227C 'pend':94C 'persist':191C 'poison':219C 'prerend':166C,175C,182C 'preview':231C,246C 'publish':155C 'receiv':122C,139C,154C 'regular':112C,129C,152C,164C 'request':101C,110C,113C,117C,121C,125C,130C,138C,148C,153C,165C 'return':250C 'revalid':209C 'rout':178C,204C,217C 'second':120C 'serv':197C,243C 'share':99C,215C 'sinc':210C 'site':232C 'time':185C 'two':115C 'unpublish':140C,187C 'use':95C 'visitor':201C 'whose':247C 'without':106C,142C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-30T16:14:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-3w37-wq28-93x7","url":"https://github.com/vercel/next.js/security/advisories/GHSA-3w37-wq28-93x7","severity":"medium","published_at":"2026-09-30T16:14:35+00:00","modified_at":"2026-09-30T16:14:35+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","fetched_at":"2026-11-09T22:53:14+00:00","note":null},{"source":"ghsa","external_id":"GHSA-3w37-wq28-93x7","url":"https://github.com/advisories/GHSA-3w37-wq28-93x7","severity":"medium","published_at":"2026-10-07T20:32:13+00:00","modified_at":"2026-10-07T20:32:15+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94544","severity":null,"published_at":"2026-10-02T16:16:52+00:00","modified_at":"2026-10-05T21:16:38+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110403,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-3w37-wq28-93x7","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-30T16:14:35+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110771,"url":"https://api.github.com/repos/vercel/next.js/security-advisories/GHSA-3w37-wq28-93x7","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110773,"url":"https://github.com/vercel/next.js/commit/bd9214f9a32854a011bf5fe58e481dffe1bbf598","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":43051,"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00179,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94544"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}