CVE-2026-94544
Reported by github_m · Published October 2, 2026
next is fixed in 16.3.8 (npm)
Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the regular request prerenders a page, the draft-dependent content can persist in the generated page and be served to later visitors until revalidation. Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed in version 16.3.8.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| next | npm | 16.3.8 |
| langfuse-fips-4 | Chainguard | 4.49.0-r7 |
| next.js | vercel | 16.3.8 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| vercel | next.js | >= 16.3.0, < 16.3.8 |
| chainguard | langfuse-fips-4 | 0 |
| npm | next | 16.3.0 |
| vercel | next.js | 16.3.0 |
| chainguard | zitadel-4 | 0 |
Timeline
- Oct 2, 2026 Coalition ESS Score
- Oct 2, 2026 CVE Published
- Oct 3, 2026 EPSS Score (6 in total, the first dated here)
- Oct 5, 2026 CVE Updated
- Oct 31, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-94544
vulnetix vdb fixes CVE-2026-94544Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-94544/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/vercel/next.js/security/advisories/GHSA-3w37-wq28-93x7 x_refsource_CONFIRM
- https://github.com/vercel/next.js/commit/bd9214f9a32854a011bf5fe58e481dffe1bbf598 x_refsource_MISC
- https://github.com/vercel/next.js/releases/tag/v16.3.8 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-94544 advisory
- https://github.com/advisories/GHSA-3w37-wq28-93x7 advisory