# CVE-2026-94484: Next.js cache key insufficiently scoped to source route

Source: https://junglewise.ai/threats/cve-2026-94484-next-js-is-a-react-framework-for-building-full-stack-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-94484 · Severity: medium · CVSS 4.8 · Published 2026-10-02

Next.js is a framework for building web applications that uses caching to improve performance. When a root-level catch-all page is combined with statically generated content, an attacker can craft a request that poisons the shared cache, causing other users to see incorrect content or triggering denial of service. This requires only a single unauthenticated request with no user interaction.

Technologies: [next (npm)](https://junglewise.ai/threats/technologies/npm-next), [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-94484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94484 being exploited in the wild.

**How severe is CVE-2026-94484?** Medium severity, with a CVSS score of 4.8, published 2 October 2026.

**Which products and versions are affected?** next (npm) SEMVER:introduced=16.0.0,fixed=16.3.8; Vercel Next.js 15.0.0 to 15.5.26, 16.0.0 to 16.3.7.

**Is there a fix for CVE-2026-94484?** Yes. next (npm): upgrade to 16.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94484 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94484?** Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next (npm): upgrade to 16.3.8 or later

  ```sh
  npm install next@16.3.8
  ```


## Technical details

The vulnerability stems from insufficient scoping of response cache keys in Next.js versions 15.0.0 through 15.5.26 and 16.0.0 through 16.3.7. When a root-level catch-all route exists alongside statically generated or incrementally regenerated routes, the cache key fails to adequately distinguish between different source routes, allowing a single request to poison a shared cache entry. Exploitation requires no authentication and results in cross-user content substitution or persistent denial of service.

## Affected products

- Vercel Next.js 15.0.0 to 15.5.26, 16.0.0 to 16.3.7

## Identifiers

- CVE-2026-94484
- GHSA-mcj8-r9mp-w47p

## Timeline

- 2026-10-02: disclosed

## References

- [https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8](https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8)
- [https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52](https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)