GHSA-3w37-wq28-93x7

Source

https://github.com/advisories/GHSA-3w37-wq28-93x7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3w37-wq28-93x7/GHSA-3w37-wq28-93x7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3w37-wq28-93x7

Aliases

CVE-2026-94544

Published

2026-10-07T20:32:13Z

Modified

2026-10-07T20:45:06Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Details

Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill:

A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication.
A Draft Mode request that overlaps a regular request receives published content instead of the draft.

If the overlapping regular request prerenders a page — for example an on-demand prerender of a route that was not prerendered at build time — the unpublished content can be persisted into the generated page and served to all later visitors of that route until the page is revalidated. Since cached functions can be shared across routes, the poisoned page does not need to be the page the editor is previewing.

Sites are affected if they enable Cache Components (or experimental.useCache) and serve Draft Mode previews whose cached functions return draft-dependent content.

Database specific

{
    "cwe_ids": [
        "CWE-524"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:32:13Z",
    "nvd_published_at": "2026-10-02T16:16:52Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / next

Package

Name: next; View open source insights on deps.dev
Purl: pkg:npm/next

Affected ranges

Type: SEMVER
Events: Introduced

16.3.0

Fixed

16.3.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3w37-wq28-93x7/GHSA-3w37-wq28-93x7.json"