All vulnerabilities

npm

CVE-2026-94543

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Severity: Medium 5.3
Published: 7 Oct 2026
Last changed: 7 Oct 2026
Added to UpHeron: 14 Oct 2026
Fixed in: 15.5.27, 16.3.8
Also known as: GHSA-4jqv-mc3x-m676
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
Next.jsnpm · `osv:npm:next`	From 15.0.0 before 15.5.27 From 16.0.0 before 16.3.8

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-94543
GitHub Advisory Database https://github.com/advisories/GHSA-4jqv-mc3x-m676