All vulnerabilities
CVE-2026-94543GHSA-4jqv-mc3x-m676

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

vercel nextnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.5.27Also 16.3.8, 15.5.? and 1 moreGitHub
Published2 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 15.5.27next, npmGitHubnpm install next@15.5.27
  • 16.3.8next, npmGitHubnpm install next@16.3.8
  • 15.5.?next, npmGitHubnpm install next@15.5.?
  • 16.3.?next, npmGitHubnpm install next@16.3.?

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Text from CVE List

Affected versions 8

  • next, npm>= 15.0.0, < 15.5.27GitHub
  • next, npm>= 16.0.0, < 16.3.8GitHub
  • next.jsaffected: >= 15.0.0, < 15.5.27CVE List
  • next.jsaffected: >= 16.0.0, < 16.3.8CVE List
  • next, npm>= 15.0.0GitHub
  • next, npm>= 16.0.0GitHub
  • next, npmfrom 15.0.0, fixed in 15.5.27OSV
  • next, npmfrom 16.0.0, fixed in 16.3.8OSV

References 7