# CVE-2026-94543: Next.js Pages Router response cache key bypass

Source: https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-94543 · Severity: medium · CVSS 5.3 · Published 2026-10-02

Next.js is a popular React framework for building web applications. A vulnerability in self-hosted applications using the Pages Router allows an attacker to replace one page's cached content with content from a different route, causing the wrong page to be served to all visitors until the cache is refreshed. This could lead to misinformation, data confusion, or phishing if an attacker can control multiple routes in the same application.

Technologies: [next (npm)](https://junglewise.ai/threats/technologies/npm-next), [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-94543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94543 being exploited in the wild.

**How severe is CVE-2026-94543?** Medium severity, with a CVSS score of 5.3, published 2 October 2026.

**Which products and versions are affected?** next (npm) SEMVER:introduced=15.0.0,fixed=15.5.27; Vercel Next.js 15.0.0 to 15.5.27; 16.0.0 to 16.3.8 (self-hosted only).

**Is there a fix for CVE-2026-94543?** Yes. next (npm): upgrade to 15.5.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94543 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-94543?** Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next (npm): upgrade to 15.5.27 or later

  ```sh
  npm install next@15.5.27
  ```


## Technical details

The vulnerability exists in Next.js Pages Router implementations with static generation or Incremental Static Regeneration (ISR) where response cache keys were not sufficiently bound to their source routes. An attacker can craft requests that cause a cache entry for one route to be overwritten with content from a different route. This affects self-hosted deployments; Vercel-hosted applications are unaffected due to additional protections. The fix scopes cache keys to include a SHA-256 hash of the source route pathname.

## Affected products

- Vercel Next.js 15.0.0 to 15.5.27; 16.0.0 to 16.3.8 (self-hosted only)

## Identifiers

- CVE-2026-94543
- GHSA-4jqv-mc3x-m676

## Timeline

- 2026-10-02: disclosed: CVE-2026-94543 published
- 2026-09-30: patched: Fix committed to canary and lts-active branches

## References

- [https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8](https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8)
- [https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52](https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Vercel Next.js information disclosure in dev server MCP endpoint](https://junglewise.ai/threats/cve-2026-94486-next-js-is-a-react-framework-for-building-full-stack-web)