Cloudanix VulnDB

CVE-2026-94544

Medium · 4.2

CVSS

4.2

EPSS

0.2%

Published

Oct 2, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in certain versions of a popular web application framework could let visitors see content that editors had not yet published.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Exposure
Component
Web Framework
Class
Information Disclosure
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Pending cache fills for the same key are shared across Draft Mode and regular requests, allowing a regular request to receive draft-dependent unpublished content or a Draft Mode request to receive published content; draft-dependent content can then persist in prerendered pages served to subsequent visitors.

Why it matters to the business

Organizations using affected Next.js versions with Cache Components or experimental.useCache enabled risk unintended exposure of unpublished editorial content to public visitors, potentially causing compliance issues or premature disclosure of sensitive material until caches are revalidated or the software is updated.

How an attack unfolds

An attacker sends overlapping regular and Draft Mode requests for the same cache key while an editor is filling the cache with draft content; the race condition causes the regular request to cache or receive the draft content, which then gets prerendered into a page served to later unauthenticated visitors.

How to fix it

Upgrade Next.js to version 16.3.8 or later; disable Cache Components or experimental.useCache until the upgrade can be completed if draft-dependent content is cached.

How to confirm the fix worked

Confirm the installed Next.js version is 16.3.8 or newer; test that Draft Mode and regular requests for the same cache key no longer cross-contaminate content and that prerendered pages do not contain draft data after revalidation.

Typical attack path

  1. Identify a Next.js site with Cache Components or experimental.useCache enabled and draft-dependent cached functions
  2. Trigger concurrent regular and Draft Mode requests targeting the same cache key during an active Draft Mode session
  3. Observe receipt of unpublished content in the regular response or persistence of that content in generated prerendered pages

How to detect it

Review application logs for concurrent requests mixing Draft Mode headers with regular traffic on cacheable routes; inspect prerendered page artifacts or cache entries for unexpected draft content; no widespread exploitation indicators have been observed.

What your security team should do

  • Prioritize upgrade to Next.js 16.3.8 for all instances using the affected cache features
  • Audit applications for use of Cache Components or experimental.useCache with draft-dependent functions and apply the fix or temporary disablement
  • Monitor EPSS and exploit maturity indicators; schedule standard patching within normal change windows given low exploitation likelihood

The record

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the regular request prerenders a page, the draft-dependent content can persist in the generated page and be served to later visitors until revalidation. Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed in version 16.3.8.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities