CVE-2026-94484: vercel next.js

csirt@kutim:~/threat-intel/cve/CVE-2026-94484

CVSS 4.8 · Medium EPSS 0,24%

Kerentanan Use of Cache Containing Sensitive Information pada vercel next.js. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.

Rincian

Terbit di NVD: 2 Oktober 2026
Terakhir diubah: 5 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-524: Use of Cache Containing Sensitive Information
EPSS (30 hari): 0,24% peluang dieksploitasi; lebih tinggi dari 14,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
vercel	next.js	Versi 15.0.0 hingga sebelum 15.5.27
vercel	next.js	Versi 16.0.0 hingga sebelum 16.3.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p advisory vendor
https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8 patch
https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52 patch
https://github.com/vercel/next.js/releases/tag/v15.5.27 release notes
https://github.com/vercel/next.js/releases/tag/v16.3.8 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 6 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.