Cache Security Flaw in Next.js Framework by Vercel
CVE-2026-94544

6.3MEDIUM

Key Information:

Vendor

Vercel
Status
Next.js
Vendor
CVE Published:
2 October 2026

What is CVE-2026-94544?

The Next.js framework, commonly used for developing full-stack web applications, has a vulnerability that affects its caching mechanism. Specifically, from versions 16.3.0 to 16.3.8, the framework improperly handles cache fill requests, allowing unauthorized access to content. In Draft Mode, content meant for internal review can inadvertently be served to users of the site if there are overlapping requests. This issue arises when Cache Components or experimental.useCache feature is enabled, leading to potential exposure of unpublished drafts or regular content. The vulnerability has been addressed in version 16.3.8.

Affected Version(s)

next.js >= 16.3.0, < 16.3.8

References

https://github.com/vercel/next.js/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/vercel/next.js/commit/bd9214f9a32854a0...
x_refsource_MISC
https://github.com/vercel/next.js/releases/tag/v16.3.8
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.