GHSA-4jqv-mc3x-m676

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-94543

Packages

Ecosystem	Package	Affected	Fixed in
npm	next	>= 15.0.0, < 15.5.27	15.5.27
npm	next	>= 16.0.0, < 16.3.8	16.3.8

Details

As written in the advisory (Markdown source, shown as plain text).

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

References

External links from the advisory. They lead to third-party sites.

https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676 web
https://nvd.nist.gov/vuln/detail/CVE-2026-94543 advisory
https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8 web
https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52 web
https://github.com/vercel/next.js package
https://github.com/vercel/next.js/releases/tag/v15.5.27 web
https://github.com/vercel/next.js/releases/tag/v16.3.8 web