A self-hosted Next.js page cache can be replaced with another route
On September 30, 2026, Next.js published GHSA-4jqv-mc3x-m676. On a self-hosted Pages Router app, a static or ISR page's cache entry can be replaced with another route's content until it is revalidated. Apps on Vercel are not affected. CVE-2026-94543 says the fixes are next 15.5.27 and 16.3.8.
What was reported
GHSA-4jqv-mc3x-m676, published September 30, 2026, says self-hosted Next.js applications that use the Pages Router with statically generated or incrementally regenerated pages can have one page's cache entry replaced with content from a different route. That page then serves the wrong content to every visitor until the entry is revalidated. The advisory says applications deployed on Vercel are not affected.
CVE-2026-94543, published October 2, 2026, says the affected ranges are next 15.0.0 until 15.5.27, and next 16.0.0 until 16.3.8. The fixes are 15.5.27 and 16.3.8. It says a request can replace one page's cache entry because the cache key is not bound tightly enough to the source route.
How to prevent it
If you self-host the Pages Router with static or incrementally regenerated pages, upgrade next to 15.5.27 on the 15.0.0 line before that release, or to 16.3.8 on 16.0.0 before 16.3.8. The advisory says applications deployed on Vercel are not affected. After you patch, revalidate any page that may already be serving another route's content.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.