CVE-2026-94484

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.

• CWE-524

• https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8Patch
• https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52Patch
• https://github.com/vercel/next.js/releases/tag/v15.5.27Release Notes
• https://github.com/vercel/next.js/releases/tag/v16.3.8Release Notes
• https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47pVendor Advisory

Published

Oct 2, 2026

Last Modified

Oct 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-94461Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 ve…6.5
• CVE-2026-94462Spree is an open source e-commerce solution built with Ruby …7.1
• CVE-2026-9447A vulnerability was found in SourceCodester Simple POS and I…7.3
• CVE-2026-9448A vulnerability was determined in code-projects Employee Man…4.3
• CVE-2026-94482Next.js is a React framework for building full-stack web app…8.2
• CVE-2026-94483Next.js is a React framework for building full-stack web app…6.5
• CVE-2026-94485Next.js is a React framework for building full-stack web app…5.3
• CVE-2026-94486Next.js is a React framework for building full-stack web app…5.4
• CVE-2026-94487Unauthenticated Cross Site Request Forgery (CSRF) in Publish…8.1
• CVE-2026-94488Telegram Desktop before 6.9.4 allows XSS in the HTML exporte…8.2
• CVE-2026-94489Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-9449A vulnerability was identified in code-projects Employee Man…6.3