CVE-2026-94543CWE-524

CVE-2026-94543

Medium · published October 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-524 · Use of Cache Containing Sensitive Information
Published
2026-10-02T20:16Z
Affected products (2)
ProductVersionsFixed in
vercel/next.js≥ 15.0.0, < 15.5.2715.5.27
vercel/next.js≥ 16.0.0, < 16.3.816.3.8
References (5)
https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8 · [email protected]https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52 · [email protected]https://github.com/vercel/next.js/releases/tag/v15.5.27 · [email protected]https://github.com/vercel/next.js/releases/tag/v16.3.8 · [email protected]https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676 · [email protected]
EPSS history
Timeline
  • 04 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 02 OCT 15:16Z
    Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
    cvelistv5