Cross-User Content Substitution Vulnerability in Next.js Framework by Vercel
CVE-2026-94484
6.3MEDIUM
What is CVE-2026-94484?
Next.js, a popular React framework, has a vulnerability in versions from 15.0.0 up to 15.5.27 and 16.3.8. This issue emanates from a shared response cache key that is not adequately scoped to the originating route when using root-level catch-all pages with statically generated or Incremental Static Regeneration routes. An unauthenticated attacker can exploit this weakness by sending a crafted request which poisons the cache, potentially leading to cross-user content substitution or persistent denial of service. The affected versions have been updated in subsequent releases to mitigate this security risk.
Affected Version(s)
next.js >= 15.0.0, < 15.5.27 < 15.0.0, 15.5.27
next.js >= 16.0.0, < 16.3.8 < 16.0.0, 16.3.8