UpHeron
All vulnerabilities

npm

CVE-2026-94484

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Severity
Medium 4.8
Published
7 Oct 2026
Last changed
7 Oct 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.27, 16.3.8
Also known as
GHSA-mcj8-r9mp-w47p
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 15.0.0 before 15.5.27
  • From 16.0.0 before 16.3.8

References