MediumGHSA-4jqv-mc3x-m676CVE-2026-94543
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Published 7 Oct 2026 · Updated 7 Oct 2026
Affected packages
nextnpm
- Affected
- >=15.0.0 <15.5.27
- Fixed in
- 15.5.27
Update to the fixed version for your release line, for example:
npm install next@15.5.27nextnpm
- Affected
- >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
Update to the fixed version for your release line, for example:
npm install next@16.3.8Details
Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.
Is GHSA-4jqv-mc3x-m676 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
- Linkgithub.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-94543
- Linkgithub.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8
- Linkgithub.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
- Packagegithub.com/vercel/next.js
- Linkgithub.com/vercel/next.js/releases/tag/v15.5.27
- Linkgithub.com/vercel/next.js/releases/tag/v16.3.8
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.