onyx --cves cve-2026-94484
CVE-2026-94484
- score
- 0.3
- cvss
- 4.8
- epss
- 0.2%
- published
- 2026-10-02
- kev added
- —
- first seen
Next.js 15.0.0 < 15.5.27 and < 16.3.8 contains a cache poisoning vulnerability caused by insufficiently scoped shared response cache keys in root-level catch-all pages with static or ISR routes, letting unauthenticated attackers cause cross-user content substitution or persistent denial of service, exploit requires crafted unauthenticated request.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8
- https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
- https://github.com/vercel/next.js/releases/tag/v15.5.27
- https://github.com/vercel/next.js/releases/tag/v16.3.8
- https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p