GHSA-4jqv-mc3x-m676 CVE-2026-94543

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Medium npm

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 0.51%; Chance of exploitation in the next 30 days. Higher than 43.22% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-524 Use of Cache Containing Sensitive Information
Fix: 15.5.27; Upgrade next to this version or later

Description

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Affected versions

npm

Package	Vulnerable	Fixed in
next	`>= 15.0.0, < 15.5.27`	`15.5.27`
next	`>= 16.0.0, < 16.3.8`	`16.3.8`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

next npm → `15.5.27`

npm

npm install next@15.5.27

yarn

yarn add next@15.5.27

pnpm

pnpm add next@15.5.27

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Weakness

CWE-524: Use of Cache Containing Sensitive Information

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

How to prevent it

Architecture and Design: Protect information stored in cache.
Architecture and Design: Do not store unnecessarily sensitive information in the cache.
Architecture and Design: Consider using encryption in the cache.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-94543

Packages

github.com/vercel/next.js

Timeline

Oct 2, 2026 Published
Oct 7, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays	Critical	Also affects next
GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used	Critical	Also affects next
GHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions	High	Also affects next
GHSA-3w37-wq28-93x7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages	Medium	Also affects next
GHSA-39w2-rjm5-chcv Next.js has information disclosure in development server's Model Context Protocol endpoint	Medium	Also affects next
GHSA-f87g-xv8r-7p7x Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass	Medium	Also affects next
GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service	Medium	Also affects next
GHSA-cjq9-62q9-8jv4 Next.js has Server-Side Request Forgery in Image Optimization	Medium	Also affects next

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor