Next.js CVE-2026-94544

Exploitable only when the site enables Cache Components or experimental.useCache AND has cached ('use cache') functions whose output depends on Draft Mode state (e.g., returning unpublished vs. published content), on affected versions 16.3.0 through 16.3.7. Exploitation further requires an editor to be actively using Draft Mode concurrently with an overlapping regular request for the same cache key, within the short window a cache fill is still pending - making it a timing race (reflected in CVSS AC:H/AT:P). Default Next.js installations without these experimental caching features enabled are not affected, and sites whose cached functions do not branch on draft state do not leak sensitive content, which substantially limits real-world exposure.

This is a genuine but moderate-severity information-disclosure flaw, not a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 and its logic is sound: exploitation is network-reachable and requires no authentication or user interaction, but AC:H plus AT:P correctly reflect that success depends on winning a timing race - an attacker's regular request must overlap an editor's in-flight Draft Mode 'use cache' fill for the same key. Impact is limited to confidentiality (VC:L), with no integrity or availability impact, consistent with CWE-524 (information leak through cache). No EPSS score was provided, the CVE is not listed in CISA KEV, and no standalone public exploit was supplied - the commit ships a regression test that reproduces the race, which demonstrates feasibility but is not a weaponized POC. Weighing these signals together: the attacker cannot reliably trigger the overlap on demand (it depends on editors actively using Draft Mode concurrently with public traffic and on sub-second I/O timing), and the vulnerable configuration (Cache Components or experimental.useCache with draft-dependent cached functions) is opt-in rather than default. The practical risk is real for content platforms with active editorial Draft Mode use but low for the large majority of Next.js deployments that do not enable these features. One nuance to verify: the published-content-persisting-into-prerendered-pages behavior can serve stale/incorrect content to later visitors, which has a mild integrity flavor the vendor rated as N - defenders relying on prerender correctness should note this.

While a logged-in editor uses Draft Mode to preview unpublished content on a site with experimental.useCache enabled, an attacker (or any ordinary visitor) sends a concurrent request for the same cached key during the brief window the editor's cache fill is still pending. Because pending fills were shared across request types, the attacker's unauthenticated request receives the editor's unpublished DRAFT content; if that request also prerenders the page, the draft content can persist and be served to subsequent visitors until revalidation. No public standalone exploit exists, though the fix commit includes a test that deterministically reproduces the race with simulated I/O latency.