CVE-2026-94484

A flaw was found in Next.js. Applications configured with root-level catch-all pages and static routes share a response cache key that does not properly distinguish between different routes. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to poison the shared application cache. Successful exploitation can result in a persistent Denial of Service (DoS) or cause unauthorized content substitution across different users until the cache entry is refreshed.

This vulnerability is rated as having a Moderate impact for Red Hat products because, although exploitation can be triggered remotely without authentication, it requires a specific application routing architecture combining root catch-all handlers with statically generated pages. While successful cache poisoning can disrupt service availability or serve incorrect responses to subsequent clients, it does not allow remote code execution or direct data compromise. Red Hat environments utilizing Next.js are only susceptible if the deployed web frontend actively implements Incremental Static Regeneration alongside root catch-all route definitions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.