CVE-2026-94543

The record

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.

Affected packages

Related vulnerabilities

• CVE-2026-105711 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before… CWE-524
• CVE-2026-105752 vLLM is an inference and serving engine for large language models. CWE-524
• CVE-2026-94484 Next.js is a React framework for building full-stack web applications. CWE-524
• CVE-2026-93748 http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache… CWE-524
• CVE-2026-88059 Angular is a development platform for building mobile and desktop web applications using… CWE-524
• CVE-2026-82755 Use of Cache Containing Sensitive Information vulnerability in ash-project… CWE-524
• CVE-2026-84933 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its… CWE-524
• CVE-2026-59903 Netty is an asynchronous, event-driven network application framework. CWE-524