CVE-2026-94543 · GHSA-4jqv-mc3x-m676
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
- Risk score
- 41/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request c…
- Affected
- next (npm) >= 15.0.0, < 15.5.27; next (npm) >= 16.0.0, < 16.3.8
- Fix
- Upgrade next to 15.5.27 or 16.3.8 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
next: Yellow, plan it in. Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list che…
The flaws
- CVE-2026-94543: Next.js has cache poisoning of SSG and ISR pages in self-hosted applications (CVSS 5.3 · EPSS 0%)
- CVE-2026-94483: Next.js has Server-Side Request Forgery in Image Optimization (CVSS 6.5 · EPSS 0%)
The fix
Upgrade next: 15.5.27 · 16.3.8 or later on your release line
Who is exposed: next (npm) >= 16.0.0, < 16.3.8
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-524 (CWE-524). 3 other warnings in 30 days
- Same product: Earlier next warnings. 5 in the last 90 days
Why it is Yellow
- CVSS 5.3 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| next | npm | >= 15.0.0, < 15.5.27 | 15.5.27 |
| next | npm | >= 16.0.0, < 16.3.8 | 16.3.8 |
References
- https://github.com/advisories/GHSA-4jqv-mc3x-m676
- https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676
- https://nvd.nist.gov/vuln/detail/CVE-2026-94543
- https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8
- https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
- https://github.com/vercel/next.js/releases/tag/v15.5.27
- https://github.com/vercel/next.js/releases/tag/v16.3.8
- https://github.com/advisories/GHSA-4jqv-mc3x-m676
Original description
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.
Last activity 2 Oct 2026. Patch Forecast updates every hour.