One request can poison a Next.js catch-all static cache
On September 30, 2026, Next.js published GHSA-mcj8-r9mp-w47p. An app with a root catch-all page plus static or ISR routes can have its shared response cache poisoned by one unauthenticated request. CVE-2026-94484 says that can swap content between visitors or keep the bad entry until it is replaced. The fixes are next 15.5.27 and 16.3.8.
What was reported
GHSA-mcj8-r9mp-w47p, published September 30, 2026, says Next.js applications that use a root-level catch-all page together with statically generated or incrementally regenerated routes can have their shared response cache poisoned by a single unauthenticated crafted request.
CVE-2026-94484, published October 2, 2026, says the affected ranges are next 15.0.0 until 15.5.27, and next 16.0.0 until 16.3.8. The fixes are 15.5.27 and 16.3.8. It says the shared cache key is not scoped tightly enough to the source route, so the poisoned entry can substitute content between visitors or persist as a denial of service until the entry is revalidated or replaced.
How to prevent it
Upgrade next to 15.5.27 if you are on 15.0.0 before that release, or to 16.3.8 if you are on 16.0.0 before 16.3.8, when the app has a root-level catch-all page and statically generated or incrementally regenerated routes. The CVE record says one unauthenticated request can poison the shared cache, and that the bad entry stays until it is revalidated or replaced.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.