UpHeron
All vulnerabilities

npm

CVE-2026-94544

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Severity
Medium 4.2
Published
7 Oct 2026
Last changed
7 Oct 2026
Added to UpHeron
14 Oct 2026
Fixed in
16.3.8
Also known as
GHSA-3w37-wq28-93x7
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 16.3.0 before 16.3.8

References