Next.js CVE-2026-94484

Exploitation requires the target application to have BOTH a root-level catch-all page (e.g. a top-level [[...slug]] route) AND statically generated or Incremental Static Regeneration (ISR) routes, running an affected version (15.0.0-15.5.26 or 16.x before 16.3.8). Under that topology, a single unauthenticated crafted request can poison a shared response cache key. Limiting factors: the flaw does NOT affect default apps lacking the root catch-all + SSG/ISR combination; exploitation is gated by high attack complexity (AC:H) and an attack requirement (AT:P) because the attacker must craft a request that collides on the under-scoped cache key for a given source route. No authentication and no user interaction are required (PR:N/UI:N confirmed by CVSS vector).

This is a genuine but moderate-priority issue, not a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw but explicitly flags high attack complexity (AC:H) and a present attack requirement (AT:P), reflecting that exploitation is gated by a specific application topology (root-level catch-all page plus SSG/ISR routes) rather than being broadly sprayable. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 6.3 'Medium' rating is consistent with a real-but-conditional risk. One signal conflict worth flagging: the vendor vector scores only availability (VA:L) with VC:N/VI:N, yet the description explicitly states 'cross-user content substitution,' which is an integrity impact that the published vector does not capture - verify impact scope with the Vercel advisory (GHSA-mcj8-r9mp-w47p). Net: prioritize patching for internet-facing Next.js apps that match the vulnerable topology, but this is not a wormable, mass-exploitable bug.

An attacker targets a public Next.js site (15.0.0-15.5.26 or a 16.x build before 16.3.8) that uses a root-level catch-all page with statically generated or ISR routes. They send a single crafted, unauthenticated HTTP request that writes into a response cache key that is insufficiently scoped to the source route, poisoning the shared entry so subsequent legitimate visitors are served substituted content or a broken response. No POC is provided, and high attack complexity (AC:H) means the attacker must understand the app's routing/caching layout to land the collision.