CVE-2026-94544

A flaw was found in Next.js. Pending cache operations do not properly separate Draft Mode requests from standard requests when fulfilling matching cache keys. Under concurrent request conditions, an unauthenticated user can receive unpublished draft content generated during an editor's session. If this content is prerendered, the draft data may persist in the application cache and be served to subsequent visitors, leading to information disclosure.

This vulnerability is rated as Low severity because successful exploitation requires highly specific prerequisites, including non-default experimental caching features and precise request timing, with impact limited to unauthorized exposure of preview data. In typical Red Hat deployments, bundled Next.js components do not utilize experimental caching concurrently with editorial preview modes, significantly constraining exposure. Furthermore, no privilege escalation or service disruption can occur, as the issue only concerns cache partition boundaries between draft previews and standard visitor requests.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.