CVE-2026-94485 vercel CVE debrief

Who should care

Defenders responsible for Next.js App Router applications built with webpack should assess exposure and prioritize patching and configuration reviews. This includes verifying generateStaticParams() configurations to prevent exploitation and potential information disclosure. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and take necessary actions to protect their systems.

Why it matters

Defenders should care about CVE-2026-94485 because it involves a potential information disclosure vulnerability in Next.js App Router applications built with webpack. The vulnerability allows attackers to request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams(). Defenders responsible for these applications should assess exposure, prioritize patching and configuration reviews, and verify generateStaticParams() configurations to prevent exploitation and potential information disclosure.

• Potential information disclosure through metadata image routes
• Possible bypass of intended dynamicParams restrictions
• Need for verification of generateStaticParams() configurations
• Requirement for patching to prevent exploitation

Technical summary

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams(). This vulnerability may lead to potential information disclosure through metadata image routes and possible bypass of intended dynamicParams restrictions. Defenders should prioritize verifying and applying patches for Next.js App Router applications built with webpack, particularly those with dynamic segments excluded from generateStaticParams().

Defensive priority

Defenders should prioritize verifying and applying patches for Next.js App Router applications built with webpack, particularly those with dynamic segments excluded from generateStaticParams().

Recommended defensive actions

• Verify and apply patches for Next.js App Router applications built with webpack
• Review and update generateStaticParams() configurations to prevent dynamic segment exposure
• Monitor metadata image routes for suspicious requests
• Perform a thorough review of affected product deployments to identify potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure successful patching
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The source corpus provides limited information about affected versions and remediation. Further verification is required to determine the full scope of impacted systems and to confirm vendor-provided patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.