The version of Next.js installed on the remote host is 15.0.0 prior to 15.5.27 or 16.0.0 prior to 16.3.8. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in the Image Optimization API, where an attacker-controlled, allow-listed remote URL can lead to requests to private IP addresses. This issue only affects versions 16.0.0 and later. (CVE-2026-94483)

- A cache poisoning vulnerability in self-hosted applications using the Pages Router with SSG or ISR pages, allowing a page's cache entry to be replaced with content from a different route. (CVE-2026-94543)

- A cache poisoning vulnerability in applications using a root-level catch-all page together with SSG or ISR routes, leading to cross-user content substitution and persistent denial of service. (CVE-2026-94484)

- An information disclosure vulnerability in App Router metadata image routes built with webpack, which ignore the 'dynamicParams' route segment option. (CVE-2026-94485)

- An information disclosure vulnerability where pending 'use cache' fills are shared between Draft Mode and regular requests, leaking unpublished content. This issue only affects versions 16.0.0 and later. (CVE-2026-94544)

- A cache leak across root param values in nested 'use cache' functions when Cache Components are enabled. This issue only affects versions 16.0.0 and later. (CVE-2026-103004)

- An information disclosure vulnerability in the development server's Model Context Protocol endpoint, which does not verify the request origin. This issue only affects versions 16.0.0 and later. (CVE-2026-94486)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending
    use cache fills for the same key are shared without separating Draft Mode requests from regular requests.
    An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode
    fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the
    regular request prerenders a page, the draft-dependent content can persist in the generated page and be
    served to later visitors until revalidation. Sites are affected when Cache Components or
    experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed
    in version 16.3.8. (CVE-2026-94544)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Next.js 是一個用於構建全棧 Web 應用程序的 React 框架。從 16.3.0 until 16.3.8，會共用相同金鑰的擱置使用快取填充，而不會將草稿模式要求與一般要求分開。
    重疊的一般要求可從編輯者的「草稿模式」填入接收未經驗證的未發佈內容，而重疊的「草稿模式」要求可從一般填入接收已發佈的內容。當一般請求預先轉譯頁面時，與草稿相關的內容可以保留在產生的頁面中，並提供給稍後的訪客，直到重新驗證為止。當啟用快取元件或experimental.useCache，且快取函式傳回與草稿相關的內容時，網站會受到影響。16.3.8 版已修正此問題。(CVE-2026-94544)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Next.js 是用于构建全栈 Web 应用程序的 React 框架。从 16.3.016.3.8until ，同一密钥的待定使用缓存填充会共享，而不将草稿模式请求与常规请求分开。
    重叠的常规请求可以从编辑器的草稿模式填充中接收未经身份验证的未发布内容，而重叠的草稿模式请求可以从常规填充中接收已发布的内容。当常规请求预渲染页面时，与草稿相关的内容可以保留在生成的页面中，并提供给以后的访问者，直到重新验证。启用了缓存组件或 experimental.useCache 并且缓存函数返回草稿相关的内容时，站点会受到影响。此问题已在 16.3.8 版本中修复。(CVE-2026-94544)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Next.js は、フルスタックの Web アプリケーションを構築するための React フレームワークです。16.3.0から16.3.8まで、同じキーに対する保留中のキャッシュ使用時の塗りつぶしは、ドラフトモードのリクエストと通常のリクエストを区別せずに共有されます。
    重複する通常のリクエストは、エディターのドラフトモードの塗りつぶしから認証されていない未公開のコンテンツを受信できますが、重複するドラフトモードのリクエストは、通常の塗りつぶしから公開されたコンテンツを受信できます。通常のリクエストでページがプリレンダリングされると、下書きに依存するコンテンツが生成されたページに残り、再検証までその後の訪問者に提供される可能性があります。Cache Components または experimental.useCache が有効で、キャッシュされた関数がドラフト依存のコンテンツを返す場合、サイトが影響を受けます。この問題はバージョン 16.3.8 で修正されています。(CVE-2026-94544)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending     use cache fills for the same key are shared without separating Draft Mode requests from regular requests.
    An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode     fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the     regular request prerenders a page, the draft-dependent content can persist in the generated page and be     served to later visitors until revalidation. Sites are affected when Cache Components or     experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed     in version 16.3.8. (CVE-2026-94544)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
115751	Next.js 15.x < 15.5.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/6/2026	11/6/2026	high
115752	Next.js 16.0.x < 16.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/6/2026	11/6/2026	high
474011	Chainguard: zitadel-4-login: security update to 4.19.4-r3	Tenable Cloud Security	Chainguard Local Security Checks	10/9/2026	10/9/2026	medium
474011	Chainguard: zitadel-4-login: security update to 4.19.4-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	10/9/2026	10/9/2026	medium
473757	SCA: security update for next (GHSA-3w37-wq28-93x7)	Tenable Cloud Security	SCA Checks	10/8/2026	10/8/2026	medium
473757	SCA: security update for next (GHSA-3w37-wq28-93x7)	Tenable Self-Hosted Container Security	SCA Checks	10/8/2026	10/8/2026	medium
362699	Linux Distros 未修補弱點：CVE-2026-94544	Nessus	Misc.	10/2/2026	11/9/2026	medium
362699	Linux Distros 未修补的漏洞：CVE-2026-94544	Nessus	Misc.	10/2/2026	11/9/2026	medium
362699	Linux Distros のパッチ未適用の脆弱性: CVE-2026-94544	Nessus	Misc.	10/2/2026	11/9/2026	medium
362699	Linux Distros Unpatched Vulnerability : CVE-2026-94544	Nessus	Misc.	10/2/2026	11/9/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium

medium

medium

medium

medium