Is CVE-2026-94543 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94543 being exploited in the wild.

How severe is CVE-2026-94543?

Medium severity, with a CVSS score of 5.3, published 2 October 2026.

Which products and versions are affected?

next (npm) SEMVER:introduced=15.0.0,fixed=15.5.27; Vercel Next.js 15.0.0 to 15.5.27; 16.0.0 to 16.3.8 (self-hosted only).

Is there a fix for CVE-2026-94543?

Yes. next (npm): upgrade to 15.5.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94543 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94543?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94543: Next.js Pages Router response cache key bypass

CVE-2026-94543 · Severity: medium · CVSS 5.3 · Published 2026-10-02

Next.js is a popular React framework for building web applications. A vulnerability in self-hosted applications using the Pages Router allows an attacker to replace one page's cached content with content from a different route, causing the wrong page to be served to all visitors until the cache is refreshed. This could lead to misinformation, data confusion, or phishing if an attacker can control multiple routes in the same application.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-94543 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94543 being exploited in the wild.
How severe is CVE-2026-94543?: Medium severity, with a CVSS score of 5.3, published 2 October 2026.
Which products and versions are affected?: next (npm) SEMVER:introduced=15.0.0,fixed=15.5.27; Vercel Next.js 15.0.0 to 15.5.27; 16.0.0 to 16.3.8 (self-hosted only).
Is there a fix for CVE-2026-94543?: Yes. next (npm): upgrade to 15.5.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94543 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94543?: Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 15.5.27 or later
```
npm install next@15.5.27
```

Technical details

The vulnerability exists in Next.js Pages Router implementations with static generation or Incremental Static Regeneration (ISR) where response cache keys were not sufficiently bound to their source routes. An attacker can craft requests that cause a cache entry for one route to be overwritten with content from a different route. This affects self-hosted deployments; Vercel-hosted applications are unaffected due to additional protections. The fix scopes cache keys to include a SHA-256 hash of the source route pathname.

Affected products

Vercel Next.js 15.0.0 to 15.5.27; 16.0.0 to 16.3.8 (self-hosted only)

Identifiers

CVE-2026-94543
GHSA-4jqv-mc3x-m676

Timeline

2026-10-02: disclosed: CVE-2026-94543 published
2026-09-30: patched: Fix committed to canary and lts-active branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.