Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in versions 15.5.27 and 16.3.8.

The version of Next.js installed on the remote host is 15.0.0 prior to 15.5.27 or 16.0.0 prior to 16.3.8. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in the Image Optimization API, where an attacker-controlled, allow-listed remote URL can lead to requests to private IP addresses. This issue only affects versions 16.0.0 and later. (CVE-2026-94483)

- A cache poisoning vulnerability in self-hosted applications using the Pages Router with SSG or ISR pages, allowing a page's cache entry to be replaced with content from a different route. (CVE-2026-94543)

- A cache poisoning vulnerability in applications using a root-level catch-all page together with SSG or ISR routes, leading to cross-user content substitution and persistent denial of service. (CVE-2026-94484)

- An information disclosure vulnerability in App Router metadata image routes built with webpack, which ignore the 'dynamicParams' route segment option. (CVE-2026-94485)

- An information disclosure vulnerability where pending 'use cache' fills are shared between Draft Mode and regular requests, leaking unpublished content. This issue only affects versions 16.0.0 and later. (CVE-2026-94544)

- A cache leak across root param values in nested 'use cache' functions when Cache Components are enabled. This issue only affects versions 16.0.0 and later. (CVE-2026-103004)

- An information disclosure vulnerability in the development server's Model Context Protocol endpoint, which does not verify the request origin. This issue only affects versions 16.0.0 and later. (CVE-2026-94486)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and
    16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static
    Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route.
    A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or
    persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in
    versions 15.5.27 and 16.3.8. (CVE-2026-94484)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and     16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static     Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route.
    A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or     persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in     versions 15.5.27 and 16.3.8. (CVE-2026-94484)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115752	Next.js 16.0.x < 16.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115751	Next.js 15.x < 15.5.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
473995	Echo: next: security update to 15.5.27	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473995	Echo: next: security update to 15.5.27	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473934	Chainguard: keep-ui-fips: security update to 0.54.3-r6	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473934	Chainguard: keep-ui-fips: security update to 0.54.3-r6	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
473800	SCA: security update for next (GHSA-mcj8-r9mp-w47p)	Tenable Cloud Security	SCA Checks	Local	medium
473800	SCA: security update for next (GHSA-mcj8-r9mp-w47p)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
362695	Linux Distros Unpatched Vulnerability : CVE-2026-94484	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-94484

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium