CVE-2026-94484: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.
References
- github.com/advisories/GHSA-mcj8-r9mp-w47p
- github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8
- github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
- github.com/vercel/next.js/releases/tag/v15.5.27
- github.com/vercel/next.js/releases/tag/v16.3.8
- github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p
- nvd.nist.gov/vuln/detail/CVE-2026-94484
Code Behaviors & Features
Detect and mitigate CVE-2026-94484 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →