CVE-2026-94543

Executive Summary

CVE-2026-94543 is a cache poisoning vulnerability in self-hosted Next.js applications that use the Pages Router with statically generated or Incremental Static Regeneration (ISR) pages. A remote, unauthenticated attacker can key a response cache entry without sufficiently binding it to the source route, replacing one page's cached content with content from a different route and causing that page to serve incorrect content to every visitor until revalidation occurs. Applications deployed on Vercel are explicitly not affected. The issue is fixed in Next.js versions 15.5.27 and 16.3.8.

Technical Analysis

The vulnerability resides in how self-hosted Next.js deployments handle response caching for the Pages Router when statically generated or Incremental Static Regeneration (ISR) pages are in use. According to the NVD description, the application "can key a response cache entry without sufficiently binding it to the source route." This is a cache key construction flaw: the cache key used to store and retrieve a rendered response does not include sufficient information to uniquely tie that entry to the route that produced it.

CWE-524 ("Use of Cache Containing Sensitive Information" family — improper cache key handling within this class) is the assigned weakness classification. In practical terms, the deficient binding means that a single inbound request can cause the cache entry belonging to one route to be populated with content generated from a different route. Once this poisoned entry exists, subsequent requests for the originally intended page are served the substituted content.

The attack surface is the HTTP request handling and response caching layer of self-hosted Next.js applications running the Pages Router. Only pages that are statically generated or subject to ISR are relevant, because these are the pages whose responses are materialized into a cache entry that can later be revalidated and served. Two important scoping constraints derive directly from the description:

1. Deployment model: Only self-hosted applications are affected. Applications deployed on Vercel are not affected, which indicates the defect is specific to the standalone/self-hosted caching path rather than the managed platform.
2. Router model: The vulnerability concerns the Pages Router. The description does not state an impact on the App Router.

The NVD description does not disclose specific internal function names, cache key composition logic, HTTP parameter names, or file paths. Accordingly, this report describes the vulnerability strictly at the class level and does not fabricate implementation details. The precise mechanism by which the cache key is considered "not sufficiently bound" to the source route is not detailed in the available intelligence, and no patch diff, commit, or advisory technical breakdown has been provided in the dataset.

The consequence of the flaw is response integrity loss for the affected page. Because ISR and static pages are shared across all visitors, a poisoned entry is not limited to the attacker's session — every subsequent visitor receives the substituted content until the entry is revalidated. The attacker does not need authentication, credentials, or user interaction, consistent with a network-reachable, low-complexity attack.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code was identified in the provided intelligence. The attack chain below is inferred from the vulnerability class (cache key not bound to source route in a caching web framework) and is constrained strictly to details present in the NVD description. No specific parameter names, endpoints, or function names are invented.

1) Reconnaissance / target identification. The attacker identifies internet-facing, self-hosted Next.js applications using the Pages Router where pages are statically generated or subject to ISR. Targets are not hosted on Vercel, since that platform is unaffected. Fingerprinting can leverage framework-identifying response headers and the presence of generated page markup (see Shodan dorks in METADATA). The attacker enumerates routes whose cached content would be valuable to substitute (e.g., high-traffic pages).

2) Triggering the flaw class. The attacker sends a crafted HTTP request designed so that the cache entry normally associated with one route is instead keyed/populated using a different route's content. Because the cache entry is not sufficiently bound to the source route, the request effectively rewrites which content is stored for that cache slot. The exact request construction depends on the undisclosed cache key composition and is not specified in the available data; at the class level, this is a request-driven cache key manipulation.

3) Payload / execution method. No code execution is involved. The "payload" is the substituted content that the attacker causes to be stored and later served, drawn from a different route's response. Because this is content substitution rather than code injection, no attacker-controlled script necessarily needs to be delivered — the attacker leverages existing routes' content. If an attacker-selected route contains attacker-influenced content, the substituted response could carry misleading or malicious material, but the description does not assert attacker-controlled content injection beyond cross-route substitution.

4) Post-exploitation impact. The affected page serves the incorrect, substituted content to every visitor until revalidation. This yields persistent content integrity failure, potential defacement-like effects, misinformation delivery, and possible user trust or downstream business damage. The impact is availability of correct content and integrity of the rendered page, not confidentiality or remote code execution. The effect persists across all users rather than being confined to the attacker.

Impact Assessment

The impact is a cache integrity / content substitution condition affecting shared, cached responses. Referencing the assigned CVSS:3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N):

• Attack Vector (AV:N): Remotely exploitable over the network.
• Attack Complexity (AC:L): No special conditions beyond a reachable affected deployment.
• Privileges Required (PR:N): No authentication needed.
• User Interaction (UI:N): No victim interaction required.
• Scope (S:U): Impact remains within the vulnerable component's security scope.
• Confidentiality (C:N): No confidentiality impact indicated.
• Integrity (I:H): High integrity impact — the served content is replaced with content from a different route.
• Availability (A:N): No availability impact indicated.

Note: No official CVSS score or vector was supplied in the CVE intelligence data (CVSS Score: N/A). The vector above is a class-based representation of the described impact and should be treated as analytical rather than authoritative. It must not be used in place of an official score if one is later published.

Blast radius: Every visitor to an affected cached page receives the substituted content until the cache revalidates, so the blast radius extends to the full user base of the affected route, not a single session. Only self-hosted deployments using the Pages Router with static/ISR pages are in scope. Vercel-hosted applications are excluded. Business impact includes loss of content trustworthiness, potential regulatory or brand consequences if incorrect content is served at scale, and operational overhead from cache invalidation and incident response.

Detection Guidance

Sigma Rule

title: Next.js Cache Key Route Mismatch - Potential Cache Poisoning (CVE-2026-94543)
id: 7c9a1f42-3b5e-4d18-9a2c-6f0d1e2b8a44
status: experimental
description: Detects anomalous request patterns that may indicate attempts to poison cached Pages Router responses in self-hosted Next.js by keying a cache entry not bound to the source route.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94543
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: nextjs
detection:
  selection_framework:
    cs-user-agent|contains: 'Next.js'
  selection_anomaly:
    - cs-uri-query|contains:
        - 'x-now-route-matches'
        - '_next'
    - cs-uri-stem|endswith: '.json'
  condition: selection_framework and selection_anomaly
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate internal ISR revalidation traffic
  - CDN or proxy normalization causing route/path mismatches
level: medium
tags:
  - attack.t1190
  - cve.2026.94543

YARA Rule

rule CVE_2026_94543_NextJS_Cache_Poisoning_Artifacts
{
    meta:
        description = "Detects Next.js ISR/static cache artifacts that may indicate route/cache-key mismatch abuse (CVE-2026-94543)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94543"
        severity = "medium"

    strings:
        $next1 = "__NEXT_DATA__" ascii
        $next2 = "__next" ascii
        $isr1  = "revalidate" ascii
        $isr2  = "s-maxage" ascii
        $cache1 = "x-nextjs-cache" ascii
        $route1 = "x-matched-path" ascii

    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x213C) and
        (any of ($next1, $next2)) and
        (any of ($isr1, $isr2, $cache1, $route1) or 1 of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94543 Possible Next.js Pages Router Cache Poisoning Attempt"; flow:established,to_server; http.header; content:"x-nextjs-cache"; nocase; http.header; content:"x-matched-path"; nocase; classtype:attempted-admin; reference:cve,2026-94543; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94543; sid:202694543; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET" and
      http.request.headers contains "x-nextjs-cache" and
      url.path != null ]
  [ network where http.response.status_code == 200 and
      http.response.headers contains "x-nextjs-cache" and
      url.path != null ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_next=if(like(lower(cs_useragent),"%next.js%") OR like(cs_uri_stem,"%_next%"),1,0)
| where is_next=1
| stats count values(cs_uri_stem) as routes dc(cs_uri_stem) as unique_routes by c_ip
| where unique_routes > 25 AND count > 50
| sort - count
| table c_ip count unique_routes routes

Wazuh OSSEC Rule

<group name="nextjs,cve-2026-94543,web,">
  <rule id="100945" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">_next|revalidate</field>
    <match>Next.js</match>
    <description>CVE-2026-94543: Possible Next.js Pages Router cache poisoning attempt - anomalous cached route request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

The NVD description states the issue is fixed in versions 15.5.27 and 16.3.8. Although a fixed version is named in the description, no patch source, vendor advisory, commit, or diff was provided in the supplied intelligence (Patch Sources: [], Vendor Fix: N/A). This report therefore treats patch verification as incomplete and recommends validating releases directly against the vendor before relying on them.

1) Immediate mitigations (until an upgrade can be validated):

• Eliminate or reduce caching for sensitive or high-value static/ISR pages by disabling static generation or setting revalidate to a very low value so poisoned entries expire quickly.
• Disable CDN/edge caching of affected pages where operationally feasible to limit the scope of a poisoned entry.
• Restrict the affected application from direct public exposure where possible; place it behind authentication or a filtering reverse proxy.
• Note: The NVD description explicitly states applications deployed on Vercel are not affected. Migration to a Vercel-managed deployment is a described non-affected configuration, subject to organizational suitability.
• Monitor and aggressively purge the Next.js response cache for affected routes if substitution is detected.

2) Patch/upgrade steps:

• Upgrade Next.js to version 15.5.27 (for the 15.x line) or 16.3.8 (for the 16.x line). These are the versions named as fixed in the NVD description.
• Because no patch source is verified in the provided data, confirm the fixed version against the authoritative Next.js release notes/security advisory before and after deployment.
• After upgrading, invalidate existing static/ISR cache entries so any previously poisoned entries are discarded.

3) Long-term hardening:

• Track Next.js security advisories and adopt a regular patch cadence for the framework.
• Prefer architectures where cache keying is well-defined and responses are bound to their source route; validate cache correctness as part of release testing.
• Implement response integrity monitoring for cached pages (e.g., checksums or content assertions on critical routes).
• Apply the principle of least exposure: avoid caching user- or business-sensitive content at edge layers where a substitution could propagate to all visitors.

References

• NVD — CVE-2026-94543: https://nvd.nist.gov/vuln/detail/CVE-2026-94543
• Next.js Security/Release Advisories (verify fixed versions 15.5.27 and 16.3.8): https://github.com/vercel/next.js/releases
• CWE-524 — Use of Cache Containing Sensitive Information (associated weakness class): https://cwe.mitre.org/data/definitions/524.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (no entry recorded for this CVE at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or evidence of exploitation in the wild was identified for CVE-2026-94543 in the provided intelligence. No CISA KEV listing and no threat actor campaign association are recorded in the supplied data.