Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the regular request prerenders a page, the draft-dependent content can persist in the generated page and be served to later visitors until revalidation. Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed in version 16.3.8.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vercel | next.js | 16.3.0 to before 16.3.8 | 16.3.8 | Patch available | CNA |
| — | next (npm) | 16.3.0 to before 16.3.8 | 16.3.8 | Patch available | GHSA-3w37-wq28-93x7 |
- next.js Vendorvercel Affected 16.3.0 to before 16.3.8 Fixed in 16.3.8 Patch available CNA
- next (npm) Vendor— Affected 16.3.0 to before 16.3.8 Fixed in 16.3.8 Patch available GHSA-3w37-wq28-93x7
Remediation
- Fix · CNA next.js (vercel) Fixed in 16.3.8
- Fix · GHSA-3w37-wq28-93x7 next (npm) Fixed in 16.3.8 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-94544
- 2026-10-04 Priority changed: MEDIUM → LOW
- 2026-10-05 CVSS score added · NVD
- 2026-10-06 CISA SSVC decision points changed
- 2026-10-07 Alias added: GHSA-3w37-wq28-93x7
- 2026-10-07 Fix available: npm/[email protected] · GHSA-3w37-wq28-93x7
- 2026-10-07 CVSS score added · GHSA-3w37-wq28-93x7
- 2026-10-07 Weakness changed · GHSA-3w37-wq28-93x7
- 2026-10-07 5 new references · GHSA-3w37-wq28-93x7
References
Advisory 2
More vercel Next.js vulnerabilities
- TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
- TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
- TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
- TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
- TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
Sources
- CVE-2026-94544 · CVE Program
- CVE-2026-94544 · NVD
- FIRST EPSS
- GHSA-3w37-wq28-93x7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-94544 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences