The version of Next.js installed on the remote host is 15.0.0 prior to 15.5.27 or 16.0.0 prior to 16.3.8. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in the Image Optimization API, where an attacker-controlled, allow-listed remote URL can lead to requests to private IP addresses. This issue only affects versions 16.0.0 and later. (CVE-2026-94483)

- A cache poisoning vulnerability in self-hosted applications using the Pages Router with SSG or ISR pages, allowing a page's cache entry to be replaced with content from a different route. (CVE-2026-94543)

- A cache poisoning vulnerability in applications using a root-level catch-all page together with SSG or ISR routes, leading to cross-user content substitution and persistent denial of service. (CVE-2026-94484)

- An information disclosure vulnerability in App Router metadata image routes built with webpack, which ignore the 'dynamicParams' route segment option. (CVE-2026-94485)

- An information disclosure vulnerability where pending 'use cache' fills are shared between Draft Mode and regular requests, leaking unpublished content. This issue only affects versions 16.0.0 and later. (CVE-2026-94544)

- A cache leak across root param values in nested 'use cache' functions when Cache Components are enabled. This issue only affects versions 16.0.0 and later. (CVE-2026-103004)

- An information disclosure vulnerability in the development server's Model Context Protocol endpoint, which does not verify the request origin. This issue only affects versions 16.0.0 and later. (CVE-2026-94486)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and
    16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static
    Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A
    request can replace one page's cache entry with content from a different route, causing the affected page
    to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not
    affected. This issue is fixed in versions 15.5.27 and 16.3.8. (CVE-2026-94543)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Next.js 是一個用於構建全棧 Web 應用程序的 React 框架。從 15.0.0 until 15.5.27 和 16.3.8，使用具有靜態產生或增量靜態再生頁面的頁面路由器的自我託管應用程式可以輸入回應快取項目，而無需將其充分繫結至來源路由。請求可能會將一個頁面的快取項目替換為來自不同路由的內容，導致受影響的頁面向每位訪客提供不正確的內容，直到重新驗證為止。部署在 Vercel 上的應用程式不受影響。此問題已在 15.5.27 和 16.3.8 版中修正。(CVE-2026-94543)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Next.js 是用于构建全栈 Web 应用程序的 React 框架。从 15.0.0 until 15.5.27 和 16.3.8，使用具有静态生成或增量静态重新生成页面的页面路由器的自托管应用程序可以在未充分绑定到源路由的情况下键入响应缓存条目。请求可将一个页面的缓存条目替换为来自不同路由的内容，从而导致受影响的页面向每个访问者提供错误的内容，直到重新验证。Vercel 上部署的应用程序不受影响。此问题已在 15.5.27 和 16.3.8 版本中得到修补。(CVE-2026-94543)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Next.js は、フルスタックの Web アプリケーションを構築するための React フレームワークです。15.0.0から15.5.27、16.3.8まで、静的に生成されたページまたは増分静的再生成ページを持つPages Routerを使用するセルフホストアプリケーションは、ソースルートに十分にバインドせずに応答キャッシュエントリにキーを設定する可能性があります。リクエストにより、あるページのキャッシュエントリが異なるルートからのコンテンツに置き換えられ、影響を受けるページが再検証まですべての訪問者に正しくないコンテンツを表示する可能性があります。Vercel に展開されているアプリケーションは影響を受けません。この問題はバージョン 15.5.27および 16.3.8で修正されています。(CVE-2026-94543)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and     16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static     Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A     request can replace one page's cache entry with content from a different route, causing the affected page     to serve incorrect content to every visitor until revalidation. Applications deployed on Vercel are not     affected. This issue is fixed in versions 15.5.27 and 16.3.8. (CVE-2026-94543)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
115751	Next.js 15.x < 15.5.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/6/2026	11/6/2026	high
115752	Next.js 16.0.x < 16.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/6/2026	11/6/2026	high
473765	SCA: security update for next (GHSA-4jqv-mc3x-m676)	Tenable Self-Hosted Container Security	SCA Checks	10/8/2026	10/8/2026	medium
473935	Chainguard: keep-ui-fips: security update to 0.54.3-r6	Tenable Cloud Security	Chainguard Local Security Checks	10/9/2026	10/9/2026	medium
473996	Echo: next: security update to 15.5.27	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/9/2026	10/13/2026	medium
473996	Echo: next: security update to 15.5.27	Tenable Cloud Security	Echo Local Security Checks	10/9/2026	10/13/2026	medium
473935	Chainguard: keep-ui-fips: security update to 0.54.3-r6	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	10/9/2026	10/9/2026	medium
473765	SCA: security update for next (GHSA-4jqv-mc3x-m676)	Tenable Cloud Security	SCA Checks	10/8/2026	10/8/2026	medium
362701	Linux Distros 未修補弱點：CVE-2026-94543	Nessus	Misc.	10/2/2026	11/9/2026	medium
362701	Linux Distros 未修补的漏洞：CVE-2026-94543	Nessus	Misc.	10/2/2026	11/9/2026	medium
362701	Linux Distros のパッチ未適用の脆弱性: CVE-2026-94543	Nessus	Misc.	10/2/2026	11/9/2026	medium
362701	Linux Distros Unpatched Vulnerability : CVE-2026-94543	Nessus	Misc.	10/2/2026	11/9/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium