CVE-2026-94484 Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
Attackers can poison the cache in Next.js apps with specific routing configurations, causing cross-user content substitution or persistent denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94484?
CVE-2026-94484 is a medium-severity vulnerability in Vercel Next.js, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.
Weakness: CWE-524
Which versions are affected by CVE-2026-94484?
4 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 15.0.0 | 15.5.27 |
next npm | From 15.0.0 | 15.5.27 |
next npm | From 16.0.0 | 16.3.8 |
next npm | From 16.0.0 | 16.3.8 |
Products include Vercel Next.js.
How do I fix CVE-2026-94484?
Upgrade next to a fixed version for your release line: 15.5.27 or 16.3.8.
Is CVE-2026-94484 being exploited?
There is no known exploitation of CVE-2026-94484 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as CLEANSTART-2026-CG59297, CLEANSTART-2026-GM70491, CLEANSTART-2026-OP24127, CLEANSTART-2026-VP22898, CLSA-2026-1791972524, CLSA-2026-1792195723 and 32 more.