Packages / next / Security

ModerateVulnerabilityGHSA-mcj8-r9mp-w47pCVE-2026-94484Published 7 Oct 2026

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Affected releases · next

  • 16.x16.0.0 – 16.3.7Fixed in 16.3.8
  • 15.x15.0.0 – 15.5.26Fixed in 15.5.27

On 16.x, the newest line:

npm install next@16.3.8
16.x

  1. Affected

    16.0.0 – 16.3.7

    41 releases

  2. Fixed

    16.3.8 – 16.4.2

    4 releases, latest

15.x

  1. Affected

    15.0.0 – 15.5.26

    80 releases

  2. Fixed

    15.5.27 – 15.5.28

    2 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.