CVE-2026-94484 vercel CVE debrief

Who should care

Defenders responsible for Next.js applications, particularly those using statically generated or Incremental Static Regeneration routes, should assess exposure and prioritize patching or mitigation to prevent potential cache poisoning and content substitution.

Why it matters

CVE-2026-94484 is a cache poisoning vulnerability in Next.js applications that use a root-level catch-all page with statically generated or Incremental Static Regeneration routes. This vulnerability can be exploited via a single unauthenticated crafted request, potentially leading to cross-user content substitution and persistent denial of service. Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or mitigations.

• Potential for cross-user content substitution, impacting application data integrity.
• Risk of persistent denial of service, affecting application availability.
• Need for verification of affected versions and exposure assessment.
• Priority for patching or applying mitigations to prevent cache poisoning.

Technical summary

The vulnerability in Next.js applications using a root-level catch-all page together with statically generated or Incremental Static Regeneration routes allows for cache poisoning via a single unauthenticated crafted request. This can lead to cross-user content substitution and persistent denial of service, impacting application data integrity and availability. The vulnerability is caused by the way Next.js handles caching in these configurations, allowing an attacker to poison the cache and cause content substitution or denial of service. Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or mitigations to prevent cache poisoning and potential content substitution

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or mitigations to prevent cache poisoning and potential content substitution or denial of service.

Recommended defensive actions

• Verify if the used Next.js version is within the affected ranges (15.0.0 to 15.5.27 or 16.0.0 to 16.3.8).
• Assess exposure by checking if the application uses a root-level catch-all page with statically generated or Incremental Static Regeneration routes.
• Apply patches or mitigations as recommended by the vendor, specifically upgrading to version 15.5.27 or 16.3.8.
• Monitor for potential cache poisoning attempts and implement compensating controls if patches cannot be applied immediately.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The source corpus provides details on the vulnerability in Next.js applications, including the conditions for cache poisoning and potential impacts. However, specific details about exploitation, victims, or business impacts are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.