Packages / next / Security

ModerateVulnerabilityGHSA-4jqv-mc3x-m676CVE-2026-94543Published 7 Oct 2026

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Affected releases · next

  • 16.x16.0.0 – 16.3.7Fixed in 16.3.8
  • 15.x15.0.0 – 15.5.26Fixed in 15.5.27

On 16.x, the newest line:

npm install next@16.3.8
16.x

  1. Affected

    16.0.0 – 16.3.7

    41 releases

  2. Fixed

    16.3.8 – 16.4.2

    4 releases, latest

15.x

  1. Affected

    15.0.0 – 15.5.26

    80 releases

  2. Fixed

    15.5.27 – 15.5.28

    2 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.