CVE-2026-94484: medium-severity vulnerability in vercel next.js
Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.2%
exploitation probability
0.2%top 86% of all CVEs
observed exploitation
nono source reports it
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
vercel · next.jsRelated CVEs — vercel next.js
In the same product, most dangerous first.
CVE-2025-29927CRITICALAuthorization Bypass in Next.js MiddlewareEPSS 99.2%CVE-2024-46982HIGHCache Poisoning in next.jsEPSS 59.2%CVE-2021-43803HIGHUnexpected server crash in Next.jsEPSS 47.3%CVE-2024-34351HIGHNext.js Server-Side Request Forgery in Server ActionsEPSS 5.5%CVE-2024-51479HIGHAuthorization bypass in Next.jsEPSS 4.0%CVE-2025-57822MEDIUMNext.js Improper Middleware Redirect Handling Leads to SSRFEPSS 2.5%
References
https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52https://github.com/vercel/next.js/releases/tag/v15.5.27https://github.com/vercel/next.js/releases/tag/v16.3.8https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p