Incident feed · ShipSecurely

Cache poisoning incidents

2 incidents filed as Cache poisoning, newest first.

• Cache poisoningSep 30, 2026

  A self-hosted Next.js page cache can be replaced with another route

  On September 30, 2026, Next.js published GHSA-4jqv-mc3x-m676. On a self-hosted Pages Router app, a static or ISR page's cache entry can be replaced with another route's content until it is revalidated. Apps on Vercel are not affected. CVE-2026-94543 says the fixes are next 15.5.27 and 16.3.8.

  • Next.js
  • npm
• Cache poisoningSep 30, 2026

  One request can poison a Next.js catch-all static cache

  On September 30, 2026, Next.js published GHSA-mcj8-r9mp-w47p. An app with a root catch-all page plus static or ISR routes can have its shared response cache poisoned by one unauthenticated request. CVE-2026-94484 says that can swap content between visitors or keep the bad entry until it is replaced. The fixes are next 15.5.27 and 16.3.8.

  • Next.js
  • npm