CVE-2026-94484

A flaw was found in Next.js. Applications configured with root-level catch-all pages and static routes share a response cache key that does not properly distinguish between different routes. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to poison the shared application cache. Successful exploitation can result in a persistent Denial of Service (DoS) or cause unauthorized content substitution across different users until the cache entry is refreshed.