CVE-2026-94484 in Next.js
Summary
by MITRE • 10/02/2026
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified within Next.js frameworks from version 15.0.0 through 15.5.27 and 16.3.8 represents a critical flaw in the server-side caching mechanism, specifically affecting applications that utilize root-level catch-all pages alongside statically generated or Incremental Static Regeneration routes. This architectural configuration is common in modern web development to optimize performance by serving pre-rendered content, but it introduces a subtle yet severe logic error in how cache keys are constructed and scoped. The core technical flaw lies in the insufficient scoping of the shared response cache key relative to its source route. When multiple distinct URLs map to the same catch-all handler or static generation path, the caching system fails to adequately distinguish between them based on their unique origin paths before storing the generated response. This oversight creates a scenario where the cache does not strictly enforce isolation between different request contexts that share underlying rendering logic but differ in their specific route parameters or query structures.
From an operational perspective, this flaw allows for cache poisoning attacks by unauthenticated actors. An attacker can craft specific HTTP requests designed to exploit the ambiguous key generation process. By submitting a maliciously constructed URL that triggers the catch-all handler with particular payload characteristics, the attacker forces the server to store a response associated with a generic or incorrectly scoped cache key. Because subsequent legitimate users accessing different but related routes may hit this same shared cache entry due to the flawed scoping logic, they receive the poisoned content intended for the attacker's request context. This results in cross-user content substitution, where sensitive information from one user session might be exposed to another, or maliciously crafted payloads are served as if they were legitimate static content. The impact extends beyond data leakage; it also facilitates persistent denial of service conditions. Since cached entries often persist until explicitly revalidated or replaced by the regeneration process, a single successful poisoning attempt can degrade application availability and integrity for an extended period without requiring continuous exploitation efforts from the attacker.
This vulnerability aligns with CWE-345, which describes Insufficient Verification of Data Authenticity, as well as CWE-113, Improper Neutralization of CRLF Sequences in HTTP Headers if header injection is involved in the poisoning vector, though primarily it falls under logic flaws related to caching mechanisms. In terms of offensive security frameworks, this behavior maps closely to MITRE ATT&CK technique T1498, Network Denial of Service, specifically through cache poisoning variants that disrupt service availability for legitimate users. It also relates to data manipulation aspects found in techniques involving server-side request forgery or injection if the poisoned content leads to further exploitation vectors such as cross-site scripting when rendered by client-side React components. The lack of strict isolation between distinct route contexts violates fundamental principles of secure state management and cache integrity, allowing an unauthenticated user to manipulate shared resources that should remain isolated per session or path context.
Mitigation strategies must prioritize immediate version upgrades for all affected environments. Organizations running Next.js versions 15.0.0 through 15.5.26 or 16.3.7 and below are advised to upgrade immediately to patched releases, specifically version 15.5.27 or 16.3.8 and later, where the cache key generation logic has been corrected to ensure proper scoping based on the source route. For applications unable to patch instantly due to dependency constraints, temporary mitigations should focus on disabling Incremental Static Regeneration for catch-all routes if possible, thereby removing the vulnerable caching layer entirely. Additionally, implementing strict input validation and sanitization on all dynamic segments within catch-all pages can reduce the attack surface, although this is not a complete solution given the fundamental logic error in key generation. Security teams should also monitor application logs for unusual patterns of requests targeting root-level catch-all paths with non-standard parameters, which may indicate active exploitation attempts. Regular security audits focusing on caching configurations and route handling logic are essential to prevent similar architectural flaws in future development cycles.