CVE-2026-94484

Executive Summary

CVE-2026-94484 is a web cache poisoning vulnerability affecting Next.js, a widely deployed React framework for building full-stack web applications. Applications running Next.js versions 15.0.0 through 15.5.26, or 16.0.0 through 16.3.7, that combine a root-level catch-all page with statically generated or Incremental Static Regeneration (ISR) routes are vulnerable to a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, resulting in cross-user content substitution or a persistent denial of service that remains in effect until the poisoned entry is revalidated or replaced.

Technical Analysis

The vulnerability is classified as CWE-524: Use of Cache Containing Sensitive Information, though in this specific instance the cache weakness manifests as cache key scoping failure. The root cause, as described by NVD, is that the affected Next.js versions derive a shared response cache key that is "insufficiently scoped to the source route." This means two logically distinct routes can resolve to the same cache key, allowing a response intended for one route to be stored and later served in response to a request for a different route.

The attack surface is limited to applications that satisfy two preconditions simultaneously:

1. Root-level catch-all page present — the application defines a catch-all page at the root level of its routing structure. This routing pattern is commonly used for CMS-driven sites, documentation portals, and marketing sites where arbitrary path segments map to dynamically resolved content.
2. Statically generated or ISR routes present — the application relies on static generation or Incremental Static Regeneration, meaning responses are computed at build time or on a revalidation schedule and served from a shared cache layer.

When both conditions are met, the scoping weakness in the shared response cache key allows an attacker to influence what is stored under that key. The NVD description confirms that a "single unauthenticated crafted request" is sufficient to poison the cache. No authentication, no user interaction, and no privileged access are required.

From a code-level perspective, the public description does not disclose the specific internal function, module, or identifier responsible for the cache key construction, and no such details should be assumed. What can be stated definitively is the mechanism: insufficient namespacing of the cache key relative to the source route. The precise normalization, delimiter, or routing parameter involved is not specified in the available intelligence, and this report will not fabricate those specifics.

The consequence of successful poisoning is twofold:

• Cross-user content substitution — subsequent legitimate users requesting the affected route receive attacker-influenced content rather than the intended response.
• Persistent denial of service — the poisoned entry remains active until it is revalidated (via the ISR schedule) or replaced, meaning the impact can outlast the originating request by a significant margin.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-94484, and no exploitation evidence has been observed in the wild. The attack chain below is inferred at the vulnerability-class level (web cache poisoning / cache key scoping failure) from the NVD description. It does not rely on fabricated function names, endpoints, or parameters.

1) Reconnaissance / target identification An attacker enumerates candidate targets by identifying Next.js applications that present both prerequisite characteristics. These signals can be gathered passively: response headers and HTML artifacts indicative of Next.js, the presence of statically served content, and route behavior consistent with a root-level catch-all handler (arbitrary paths returning dynamic content). Shodan and similar internet-wide scanners can be used to shortlist deployments exposing Next.js fingerprints. The attacker does not require any credentials at this stage.

2) Triggering the flaw class The attacker issues a crafted, unauthenticated HTTP request engineered so that the framework's response cache stores a response under a key that is shared with a different source route. Because the cache key is insufficiently scoped, the attacker's request causes an entry to be written that will subsequently be served to requests for the victim route. The exact request construction (path segments, headers, or query parameters) is not disclosed in the available intelligence — only that a single crafted request is sufficient.

3) Payload / execution at the vulnerability-class level This is a cache poisoning attack, not remote code execution. The "payload" is the attacker-controlled response body or response state that becomes cached. There is no code execution on the server; instead, the attacker corrupts the integrity of the serving layer. The crafted request itself is the delivery mechanism.

4) Post-exploitation impact Once the poisoned cache entry is live, all users requesting the affected route receive the substituted content until revalidation or replacement occurs. In the content-substitution case, this supports defacement, misinformation, phishing content injection, or trust erosion. In the denial-of-service case, the poisoned entry renders the route unavailable or unusable for legitimate users. Because the entry persists across the ISR lifecycle, the operational impact continues after the attacker's request has completed.

Impact Assessment

CVE-2026-94484 carries no official CVSS score from NVD and has not yet been scored by FIRST.org's EPSS. The vector provided in this report (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) is an analytical estimate based on the described characteristics: network-reachable, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact (content substitution), and high availability impact (persistent denial of service).

Business impact:

• Integrity of served content — attacker may substitute content served to all users of the affected route, undermining trust in the application and enabling downstream social engineering or brand damage.
• Availability — persistent denial of service persists until revalidation, creating extended outages without continuous attacker effort.
• Cross-user blast radius — because the cache is shared, a single request affects every user of the affected route, not just the requester.

Affected systems: Production Next.js deployments on versions 15.0.0–15.5.26 and 16.0.0–16.3.7 that use a root-level catch-all page together with static generation or ISR routes. Applications without the root-level catch-all page, or without static/ISR routes, are outside the described vulnerable configuration.

Detection Guidance

Sigma Rule

title: Next.js Cache Poisoning Attempt via Shared Response Cache Key (CVE-2026-94484)
id: 8f3a2c1e-5b7d-4e9a-a1c2-3d6f8b0e7c45
status: experimental
description: Detects anomalous requests targeting Next.js applications that may abuse an insufficiently scoped shared response cache key to poison statically generated or ISR routes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94484
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_nextjs:
    cs-user-agent|contains:
      - 'Next.js'
  selection_anomalous_path:
    cs-uri-stem|contains:
      - '//'
      - '/%2f'
      - '..'
    cs-uri-query|contains:
      - 'cache'
      - 'revalidate'
  condition: selection_nextjs and selection_anomalous_path
falsepositives:
  - Legitimate crawlers sending non-standard paths
  - Internal health checks
level: medium
tags:
  - attack.t1499
  - cve.2026.94484

YARA Rule

rule CVE_2026_94484_NextJS_Cache_Poisoning
{
    meta:
        description = "Detects artifacts consistent with Next.js cache poisoning attempts targeting CVE-2026-94484"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94484"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $next_data = "__NEXT_DATA__" ascii wide
        $xnext = "x-nextjs-cache" ascii nocase
        $isr = "stale-while-revalidate" ascii nocase
        $catchall = "/[.../" ascii
        $revalidate = "revalidate" ascii nocase
        $cachepoison = "x-cache" ascii nocase

    condition:
        $next_data and 2 of ($xnext, $isr, $catchall, $revalidate, $cachepoison)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94484 Next.js Shared Response Cache Key Poisoning Attempt"; flow:established,to_server; http.header; content:"x-nextjs-cache"; nocase; http.uri; content:"/[..."; depth:8; reference:cve,2026-94484; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94484; classtype:attempted-dos; sid:202694484; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "GET" and
     http.request.headers contains "x-nextjs" and
     url.path : "*[...*"]
  [network where http.response.status_code in (200, 304) and
     http.response.headers contains "x-nextjs-cache"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_nextjs=if(match(http_user_agent, "(?i)next"), 1, 0)
| where is_nextjs=1
| eval suspicious=tostring(mvcount(mvfilter(match(mvdedup(mvappend(uri_path, uri_query)), "(\[\.\.\.|revalidate|//|%2f)")))))
| where suspicious > 0
| stats count values(uri_path) as paths values(uri_query) as queries by clientip
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,nextjs,cve-2026-94484">
  <rule id="2026944" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/\[\.\.\.</field>
    <description>CVE-2026-94484: Possible Next.js shared response cache poisoning attempt detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
  <rule id="2026945" level="12">
    <if_sid>2026944</if_sid>
    <regex>nextjs-cache|stale-while-revalidate</regex>
    <description>CVE-2026-94484: Confirmed Next.js cache key anomaly with cache header correlation</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). However, the NVD description states the issue is fixed in Next.js versions 15.5.27 and 16.3.8. Treat version upgrades as the primary remediation path, and validate patch availability against official Next.js release channels before relying on them.

1) Immediate mitigations

• If running Next.js 15.0.0–15.5.26 or 16.0.0–16.3.7 with a root-level catch-all page and static/ISR routes, assess exposure and elevate priority for upgrade planning.
• Where immediate upgrade is not feasible, avoid combining a root-level catch-all page with static generation or ISR on the same deployment; refactor routing so catch-all handling does not share a cache scope with statically generated routes.
• Reduce ISR revalidation intervals where operationally possible so that any poisoned entry is replaced sooner, limiting persistence of the denial-of-service condition.
• Place a correctly scoping reverse proxy or CDN cache in front of the application, and configure it to namespace cache keys by full request path and relevant headers, so an upstream poisoning attempt cannot propagate through the edge cache.
• Monitor for unexpected content substitution on statically generated routes and for repeated revalidation churn.

2) Patch / upgrade steps

• Upgrade to Next.js 15.5.27 or later on the 15.x line, or to 16.3.8 or later on the 16.x line, as stated in the NVD description.
• After upgrading, purge existing response caches to evict any poisoned entries created pre-upgrade.
• Verify the running version via the framework's version reporting and confirm the deployed artifact actually contains the fix, since patch confidence from tracked sources is currently zero.

3) Long-term hardening

• Adopt a standing policy of scoping cache keys to the full source route, including all request dimensions that influence response content.
• Include cache-key scoping and cache poisoning in security review checklists for routing and rendering changes.
• Track Next.js security advisories and subscribe to release notifications to shorten exposure windows.
• Integrate the detection rules above into SOC monitoring and tune them against baseline traffic to reduce false positives from legitimate crawlers.

References

• NVD — CVE-2026-94484: https://nvd.nist.gov/vuln/detail/CVE-2026-94484
• Next.js project / release notes (vendor source for 15.5.27 and 16.3.8): https://github.com/vercel/next.js/releases
• CWE-524 — Use of Cache Containing Sensitive Information: https://cwe.mitre.org/data/definitions/524.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA KEV Catalog (CVE-2026-94484 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild evidence is currently available for CVE-2026-94484. No threat actor campaigns have been associated with this CVE at this time.