CVE-2026-94544

score

0.3

cvss

4.2

epss

0.2%

published

2026-10-02

kev added

—

first seen

2026-10-21

Next.js 16.3.0 to 16.3.8 contains an information disclosure caused by shared cache fills mixing Draft Mode and regular requests, letting attackers access unpublished draft content or published content incorrectly, exploit requires use of Cache Components or experimental.useCache with draft-dependent content.