{"id":"CVE-2026-94484","title":"Next.js is a React framework for building full-stack web applications","summary":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a share…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-524"],"vendor":"vercel","product":"next.js","affected":["next.js >= 15.0.0, < 15.5.27","next.js >= 16.0.0, < 16.3.8"],"published":"2026-10-02","updated":"2026-10-02","sourceUpdated":"2026-10-02T17:55:42.580","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94484","references":[{"url":"https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8","label":"security-advisories@github.com"},{"url":"https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52","label":"security-advisories@github.com"},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.27","label":"security-advisories@github.com"},{"url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","label":"security-advisories@github.com"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"cvssSource":"cna","ingestedAt":"2026-10-02T16:22:59.536Z","slug":"CVE-2026-94484","body":"## Overview\n\nNext.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}