Next.js CVE-2026-94543

Exploitable only against self-hosted Next.js applications (versions 15.0.0 up to but not including 15.5.27, and 16.x up to but not including 16.3.8) that use the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages; the response cache keys entries without sufficiently binding them to the originating source route. Limiting factors: applications deployed on Vercel are explicitly NOT affected; App Router-only sites and sites without SSG/ISR cached pages are not in scope; and the CVSS AC:H/AT:P metrics indicate exploitation requires specific conditions (e.g. timing around when a cache entry is keyed/written) rather than a single deterministic request, even though no authentication (PR:N) or user interaction (UI:N) is needed.

This is a medium-severity (CVSS 4.0 base 6.3) response-cache poisoning / confusion issue, and the available signals consistently point to a moderate-to-low real-world priority rather than an urgent one. The CVSS vector (AV:N/AC:H/AT:P/PR:N/UI:N) shows it is network-reachable and unauthenticated, but both high attack complexity (AC:H) and a present attack requirement (AT:P) indicate exploitation depends on specific, hard-to-control conditions (e.g. timing/race around cache keying) rather than a trivial single request. Impact is narrow: the vendor scored only VA:L with no confidentiality or integrity vulnerable-system impact, reflecting degraded correctness/availability of served content rather than code execution or data theft. No EPSS score was provided in the input, there is no CISA KEV listing, and no public proof-of-concept is referenced - so by the precision rules this is 'no public exploit identified at time of analysis.' The main caveat: the description ('replace one page's cache entry with content from a different route ... serves incorrect content to every visitor') describes a cross-route content-substitution effect that is arguably an integrity impact affecting all site visitors, which sits in tension with the vendor's choice of VA:L (availability) and VI:N (no integrity) - verify impact framing with the vendor. Exposure is further bounded to self-hosted deployments using the Pages Router with SSG/ISR; Vercel-hosted apps are explicitly unaffected.

An unauthenticated remote attacker repeatedly sends crafted requests to a self-hosted Next.js Pages Router site that uses statically generated or ISR pages, exploiting insufficient binding between the response-cache key and the source route so a cache entry for one page is written from a different route's content. Once the entry is poisoned, every visitor to the affected page receives the wrong content until the next revalidation. Success requires meeting specific conditions (AC:H/AT:P) such as timing, and no public proof-of-concept is currently identified.