GitHub Advisoryadvisory · npm

GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

MEDIUM Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-94543
Ecosystem
npm
Packages
next
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-524
Reviewed
2026-10-07

Affected packages

• npm next: >= 15.0.0, < 15.5.27 → fixed in 15.5.27 • npm next: >= 16.0.0, < 16.3.8 → fixed in 16.3.8

Description

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Related

Alias · CVE (1)

  • CVE-2026-94543 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-524 Use of Cache Containing Sensitive Information weakness

References