CVE-2026-94484: Next.js Cache Poisoning Vulnerability Leading to Cross-User Content Substitution
Summary
CVE-2026-94484: Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted req... Affects next across 2 version ranges.
>= 15.0.0, < 15.5.27
>= 16.0.0, < 16.3.8
Fixed in 15.5.27 or 16.3.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular React framework that enables developers to build server-rendered and statically generated web applications. It offers features like automatic code splitting, optimized performance, and static site generation. However, certain configurations, particularly the use of root-level catch-all pages with statically generated or Incremental Static Regeneration routes, can expose applications to cache poisoning vulnerabilities.
Vulnerability Detail
The vulnerability arises from the way Next.js handles caching for shared responses. When a root-level catch-all page is used alongside statically generated or Incremental Static Regeneration routes, an unauthenticated user can send a crafted request that poisons the shared response cache. This can lead to cross-user content substitution, where one user may receive content intended for another, and can also result in persistent denial of service as the cache becomes unreliable.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 15.0.0, < 15.5.2715.5.27npm install next@15.5.27 -
>= 16.0.0, < 16.3.816.3.8npm install next@16.3.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using root-level catch-all pages in conjunction with statically generated or Incremental Static Regeneration routes until the package is updated. This can help mitigate the risk of cache poisoning.
Conclusion
The Next.js cache poisoning vulnerability (CVE-2026-94484) poses significant risks to applications using specific configurations. It is crucial for developers to update their Next.js packages to the latest patched versions to mitigate these risks and ensure the integrity of their applications.
See every vulnerability recorded for next →
FAQ
Cache poisoning is an attack where an attacker manipulates a cache to serve incorrect or malicious content to users.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can alert you in real-time if your application is affected by this vulnerability.
The consequences include cross-user content substitution, where users may see content intended for others, and persistent denial of service due to cache corruption.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
