CVE-2026-94543

A flaw was found in Next.js. In self-hosted applications using the Pages Router with static generation or Incremental Static Regeneration (ISR), response cache entries are not sufficiently bound to their source route. A remote attacker can exploit this issue by sending crafted requests to replace a page's cache entry with content from a different route. This results in response cache poisoning, causing the application to serve incorrect content to subsequent visitors.

This vulnerability is evaluated as a Moderate severity issue because exploitation requires specific routing preconditions to induce cache corruption and does not allow arbitrary code execution or data exfiltration. In Red Hat environments hosting Next.js services, exposure is limited to self-managed deployments actively utilizing the Pages Router alongside statically generated or incrementally regenerated pages. Environments serving pages dynamically, using the App Router, or relying on external hosting platforms that manage caching independently are not vulnerable to this route-binding flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.