GHSA-3w37-wq28-93x7 CVE-2026-94544
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.18%
- Chance of exploitation in the next 30 days. Higher than 7.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-524 Use of Cache Containing Sensitive Information
- Fix
16.3.8- Upgrade next to this version or later
Description
Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill:
- A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication.
- A Draft Mode request that overlaps a regular request receives published content instead of the draft.
If the overlapping regular request prerenders a page — for example an on-demand prerender of a route that was not prerendered at build time — the unpublished content can be persisted into the generated page and served to all later visitors of that route until the page is revalidated. Since cached functions can be shared across routes, the poisoned page does not need to be the page the editor is previewing.
Sites are affected if they enable Cache Components (or experimental.useCache) and serve Draft Mode previews whose cached functions return draft-dependent content.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| next | >= 16.3.0, < 16.3.8 |
16.3.8 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
next npm → 16.3.8
- npm
npm install next@16.3.8- yarn
yarn add next@16.3.8- pnpm
pnpm add next@16.3.8
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-524: Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
How to prevent it
- Architecture and Design: Protect information stored in cache.
- Architecture and Design: Do not store unnecessarily sensitive information in the cache.
- Architecture and Design: Consider using encryption in the cache.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays | Critical | Also affects next |
| GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used | Critical | Also affects next |
| GHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions | High | Also affects next |
| GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications | Medium | Also affects next |
| GHSA-39w2-rjm5-chcv Next.js has information disclosure in development server's Model Context Protocol endpoint | Medium | Also affects next |
| GHSA-f87g-xv8r-7p7x Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass | Medium | Also affects next |
| GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service | Medium | Also affects next |
| GHSA-cjq9-62q9-8jv4 Next.js has Server-Side Request Forgery in Image Optimization | Medium | Also affects next |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor