CVE-2026-94544

Executive Summary

CVE-2026-94544 is an information-disclosure vulnerability in Next.js versions 16.3.0 through 16.3.7 affecting applications that use Cache Components or the experimental useCache feature. The flaw arises because pending cache fills for the same cache key do not separate Draft Mode requests from regular requests, allowing an overlapping regular request to receive unpublished draft content — and potentially persisting that content into prerendered pages served to later visitors. Exploitation requires a race condition between concurrent requests and is only possible when cached functions return draft-dependent content.

Technical Analysis

The vulnerability is classified as CWE-524: Use of Cache Containing Sensitive Information. The Next.js caching subsystem in affected versions treats pending cache fills for a given key as interchangeable. When a Draft Mode request and a regular request overlap for the same cache key, the pending fill from one context can be consumed by the other.

Two distinct leakage directions are described:

• A regular (unauthenticated) request overlapping an editor's Draft Mode fill can receive unpublished content that was intended only for draft preview.
• A Draft Mode request overlapping a regular fill can receive published content instead of the draft — a correctness/integrity issue for editors.

The more severe consequence is cache poisoning of prerendered output. When the regular request that received draft content proceeds to prerender a page, that draft-dependent content can be embedded in the generated page cache. Subsequent visitors then receive the draft content until the page is revalidated. This turns a transient request race into a persistent disclosure of unpublished material to unauthenticated users.

Attack surface is limited to deployments meeting all of the following conditions:

• Next.js 16.3.0 ≤ version ≤ 16.3.7
• Cache Components or experimental.useCache enabled
• Cached functions that return content that varies by Draft Mode state

The vulnerability is not a memory-safety issue, injection flaw, or authentication bypass in the traditional sense. It is a cache-context confusion defect in the cache-fill coordination logic. No specific internal function names, cache implementation symbols, HTTP endpoints, or parameter names are provided in the NVD description, so code-level reconstruction is not possible from available data.

The fix in version 16.3.8 presumably partitions pending cache fills by request context (Draft Mode versus regular), preventing cross-context consumption. The exact implementation of the fix is not detailed in the available data.

Exploitation Scenarios

No public PoC is available. The attack chain is inferred from the vulnerability class (cache context confusion / CWE-524).

1. Reconnaissance and target identification

   • Identify Next.js sites running versions 16.3.0–16.3.7 with Cache Components or experimental.useCache enabled.
   • Identify cached routes or data functions that serve draft-dependent content (e.g., CMS-backed pages where editors preview unpublished changes via Draft Mode). The public-facing manifestation may be observable through response caching behavior on frequently requested pages.

2. Triggering the flaw

   • The attacker cannot directly manipulate an editor's Draft Mode session, so this is not a straightforward single-request exploit. The mechanism requires overlap: an editor (or an automated preview workflow) initiating a Draft Mode fill for a cache key while a regular request targets the same key within the fill window.
   • From the attacker's side, the practical approach is high-frequency, concurrent requests against routes that are likely to be under active draft preview, maximizing the probability that a regular request's pending fill is satisfied by the editor's Draft Mode fill.
   • The editor side is generally not the attacker; the race is between legitimate editorial activity and attacker traffic.

3. Payload/execution method

   • No application-layer payload is required. The "payload" is timing and volume: concurrent HTTP requests issued against the same cached route during a window when a Draft Mode fill is pending.
   • No specific URL paths, headers, cookies, or parameters can be cited because none are provided in the NVD description.

4. Post-exploitation impact

   • Immediate: the regular request response may contain unpublished content.
   • Persistent: if that regular request triggers or participates in prerendering, the draft-dependent content can be written into the generated page and served to all later visitors until revalidation, disclosing unpublished material at scale.

Impact Assessment

Business impact is information disclosure of unpublished or draft-only content, which may include embargoed announcements, pre-publication pricing, unreleased product details, or editorial material not intended for public release. Persistence via prerendered page cache elevates the impact from a low-probability race artifact to potentially site-wide exposure of that content for the cache lifetime.

Blast radius is bounded by deployment configuration. Only Next.js 16.3.0–16.3.7 instances with Cache Components or experimental.useCache enabled and draft-dependent cached functions are affected. Sites without these features are not affected.

CVSS is not assigned (N/A) per the provided data. The estimated vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N reflects network reachability, high attack complexity due to the required race condition, no privileges required from the attacker perspective, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. This estimate is analytical and should not be treated as a CNA-assigned score.

CISA KEV: NO. EPSS: not yet scored by FIRST.org.

Detection Guidance

Caching-layer context confusion is difficult to detect via signatures because exploitation relies on request timing rather than malicious payloads. The following rules are heuristic and target anomalous request concurrency against cached Next.js routes and cache-state inconsistencies.

Sigma Rule

title: Suspicious Concurrent Requests Against Next.js Cached Routes
id: 8f1c2e40-3b7a-4d9c-9e21-cve202694544
status: experimental
description: Detects high-frequency concurrent requests against Next.js routes that may indicate attempts to race pending cache fills and expose draft content (CVE-2026-94544).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94544
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1213
logsource:
  category: webserver
  product: nextjs
detection:
  selection_method:
    cs-method: 'GET'
  selection_burst:
    - cs-uri-stem|contains: '/'
  timeframe: 5s
  condition: selection_method | count() by c-ip > 40
fields:
  - c-ip
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate high-traffic load balancer health checks
  - CDN prefetching
level: low

YARA Rule

rule CVE_2026_94544_NextJS_Draft_Cache_Leak
{
    meta:
        description = "Detects unpublish/draft content markers in Next.js cache or prerender artifacts potentially leaked via CVE-2026-94544"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94544"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $draft1 = "draftMode" ascii nocase
        $draft2 = "__prerender_bypass" ascii
        $draft3 = "__next_preview_data" ascii
        $cache1 = "useCache" ascii nocase
        $cache2 = "cacheComponents" ascii nocase
    condition:
        filesize < 5MB and
        (2 of ($draft*) and 1 of ($cache*))
}

Note: the __prerender_bypass and __next_preview_data strings are standard Next.js Draft Mode cookie identifiers and are used here as generic framework markers for cache artifacts, not as values confirmed in the CVE description.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94544 Next.js Draft Mode cache context confusion attempt"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Cookie"; content:"__prerender_bypass"; nocase; threshold: type both, track by_src, count 30, seconds 5; classtype:attempted-recon; sid:90094544; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and http.request.method == "GET"] with runs=40

Splunk SPL Query

index=web sourcetype=nextjs_access
| eval is_cached=if(match(uri_path, "^/(api|_next|.*)$"), 1, 0)
| bin _time span=5s
| stats count as req_count dc(uri_path) as distinct_paths by clientip, _time
| where req_count > 40 and distinct_paths < 5
| table _time, clientip, req_count, distinct_paths

Wazuh OSSEC Rule

<group name="web,nextjs,cve-2026-94544">
  <rule id="100944" level="6">
    <if_sid>31100</if_sid>
    <field name="url">/</field>
    <description>CVE-2026-94544: possible Next.js draft cache race - excessive concurrent requests from single source</description>
    <group>cve_2026_94544,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 16.3.8, but no vendor advisory, commit, or release artifact is present in the tracked data to independently confirm; treat as unverified until validated against the official Next.js release.

1. Immediate mitigations

   • Disable Draft Mode preview functionality on internet-facing production deployments where feasible, or restrict preview traffic to authenticated editor networks only.
   • If Cache Components or experimental.useCache is enabled, consider disabling it until an upgrade is applied.
   • Ensure cached functions do not return draft-dependent content; separate draft preview routes from cached public routes so the two contexts never share a cache key.
   • Apply short revalidation windows and cache-busting on any route where draft-dependent content may be served, to limit persistence of any leaked content.
   • Monitor for and purge prerendered pages containing draft content.

2. Patch/upgrade steps

   • Upgrade Next.js to version 16.3.8 or later.
   • Rebuild and redeploy the application, then invalidate existing caches and prerendered pages to remove any content written by the vulnerable version.
   • Verify the installed version in package.json/lockfile after upgrade.

3. Long-term hardening

   • Enforce strict context separation between draft/preview and public cache namespaces in application code.
   • Add regression tests asserting that Draft Mode content never reaches a regular cache key.
   • Log and alert on draft content appearing in responses to unauthenticated clients.
   • Maintain an inventory of framework versions and subscribe to Next.js security advisories.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94544
• Next.js releases / security advisories: https://github.com/vercel/next.js/releases
• CWE-524 — Use of Cache Containing Sensitive Information: https://cwe.mitre.org/data/definitions/524.html
• Next.js Draft Mode documentation: https://nextjs.org/docs/app/building-your-application/configuring/draft-mode
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

No threat actor campaigns or exploit-in-the-wild evidence are known for CVE-2026-94544. Not listed in CISA KEV. No public PoC or Nuclei template observed.