Is CVE-2026-94484 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94484 being exploited in the wild.

How severe is CVE-2026-94484?

Medium severity, with a CVSS score of 4.8, published 2 October 2026.

Which products and versions are affected?

next (npm) SEMVER:introduced=16.0.0,fixed=16.3.8; Vercel Next.js 15.0.0 to 15.5.26, 16.0.0 to 16.3.7.

Is there a fix for CVE-2026-94484?

Yes. next (npm): upgrade to 16.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94484 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-94484?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94484: Next.js cache key insufficiently scoped to source route

CVE-2026-94484 · Severity: medium · CVSS 4.8 · Published 2026-10-02

Next.js is a framework for building web applications that uses caching to improve performance. When a root-level catch-all page is combined with statically generated content, an attacker can craft a request that poisons the shared cache, causing other users to see incorrect content or triggering denial of service. This requires only a single unauthenticated request with no user interaction.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-94484 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94484 being exploited in the wild.
How severe is CVE-2026-94484?: Medium severity, with a CVSS score of 4.8, published 2 October 2026.
Which products and versions are affected?: next (npm) SEMVER:introduced=16.0.0,fixed=16.3.8; Vercel Next.js 15.0.0 to 15.5.26, 16.0.0 to 16.3.7.
Is there a fix for CVE-2026-94484?: Yes. next (npm): upgrade to 16.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94484 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-94484?: Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 16.3.8 or later
```
npm install next@16.3.8
```

Technical details

The vulnerability stems from insufficient scoping of response cache keys in Next.js versions 15.0.0 through 15.5.26 and 16.0.0 through 16.3.7. When a root-level catch-all route exists alongside statically generated or incrementally regenerated routes, the cache key fails to adequately distinguish between different source routes, allowing a single request to poison a shared cache entry. Exploitation requires no authentication and results in cross-user content substitution or persistent denial of service.

Affected products

Vercel Next.js 15.0.0 to 15.5.26, 16.0.0 to 16.3.7

Identifiers

CVE-2026-94484
GHSA-mcj8-r9mp-w47p

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.