{"id":"EUVD-2026-91674","enisaUuid":"ce2286d4-b010-36e4-a205-b0d98b4e5268","description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","datePublished":"Oct 2, 2026, 3:26:48 PM","dateUpdated":"Oct 5, 2026, 8:07:39 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p\nhttps://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8\nhttps://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52\nhttps://github.com/vercel/next.js/releases/tag/v15.5.27\nhttps://github.com/vercel/next.js/releases/tag/v16.3.8\n","aliases":"CVE-2026-94484\nGHSA-mcj8-r9mp-w47p\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"3789dff1-dc98-35a5-ae48-7a7552baef93","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.3.8"},{"id":"7783feda-1989-3611-9386-7ea7dc65acb6","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"15.0.0, \u003c 15.5.27"}],"enisaIdVendor":[{"id":"0fd3910c-deec-3003-9d8e-02c7c3dbd81e","vendor":{"name":"vercel"}}],"enisaIdVulnerability":[{"id":"43a26eea-7d20-3916-b10c-e60ee2e0d04f","vulnerability":{"id":"CVE-2026-94484","description":"Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.","datePublished":"Oct 2, 2026, 3:26:48 PM","dateUpdated":"Oct 5, 2026, 8:07:39 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p\nhttps://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8\nhttps://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52\nhttps://github.com/vercel/next.js/releases/tag/v15.5.27\nhttps://github.com/vercel/next.js/releases/tag/v16.3.8\n","enisa_id":"EUVD-2026-91674\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 9, 2026, 3:08:14 PM","vulnerabilityProduct":[{"id":"29a283b2-ad3e-3cc5-811f-2d3cd2bf3327","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"15.0.0, \u003c 15.5.27"},{"id":"8d9474e6-db48-378f-a04f-ede9ba53b95c","product":{"name":"next.js","vendor":{"name":"vercel"}},"product_version":"16.0.0, \u003c 16.3.8"}],"vulnerabilityVendor":[{"id":"ea48a8cf-559b-36bd-9b70-93864197fcba","vendor":{"name":"vercel"}}]}},{"id":"eb66caa0-8ae3-3971-b3b3-0025bac1caf2","vulnerability":{"id":"GHSA-mcj8-r9mp-w47p","description":"Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service","datePublished":"Oct 7, 2026, 8:31:13 PM","dateUpdated":"Oct 7, 2026, 8:31:14 PM","baseScore":0.0,"references":"https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94484\nhttps://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8\nhttps://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52\nhttps://github.com/vercel/next.js\nhttps://github.com/vercel/next.js/releases/tag/v15.5.27\nhttps://github.com/vercel/next.js/releases/tag/v16.3.8\n","enisa_id":"EUVD-2026-91674\n","aliases":"CVE-2026-94484\nGHSA-mcj8-r9mp-w47p\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}