An overlapping Next.js request can receive Draft Mode content
On September 30, 2026, Next.js published GHSA-3w37-wq28-93x7. Pending use cache fills do not separate Draft Mode from a normal request, so an overlapping visitor can receive unpublished content with no login. CVE-2026-94544 says next 16.3.0 before 16.3.8 is affected. The fix is 16.3.8.
What was reported
GHSA-3w37-wq28-93x7, published September 30, 2026, says pending use cache fills for the same key are shared without distinguishing Draft Mode from a regular request. A regular request that overlaps an editor's Draft Mode request receives unpublished content without authentication. A Draft Mode request that overlaps a regular request receives the published content instead. If the regular request prerenders a page, the unpublished content can be stored in that page and served to later visitors until the page is revalidated. Cached functions can be shared across routes, so the stored page does not have to be the page the editor is previewing. Sites are affected when Cache Components or experimental.useCache is enabled and a cached function returns draft-dependent content.
CVE-2026-94544, published October 2, 2026, says the affected range is next 16.3.0 until 16.3.8, and that 16.3.8 is the fix.
How to prevent it
Upgrade next to 16.3.8 if you are on 16.3.0 before 16.3.8, Cache Components or experimental.useCache is on, and a cached function returns content that depends on Draft Mode. The advisory says a regular request that overlaps a Draft Mode fill can receive unpublished content without authentication, and that fill can be saved into a prerendered page until you revalidate it.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.