CVE-2026-94484

About vulnerability

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.

Affected product:

Next.js , React , arcjet-js , arcjet-logger , arcjet-skills , auth0-nextjs-auth0 , connect-es , create-next-app , create-storybook , json-render , json-render-codegen , json-render-core , json-render-devtools , json-render-devtools-react , json-render-devtools-solid , json-render-devtools-svelte , json-render-devtools-vue , json-render-directives , json-render-image , json-render-ink , json-render-mcp , json-render-next , json-render-react , json-render-react-email , json-render-react-native , json-render-react-pdf , json-render-react-three-fiber , json-render-redux , json-render-remotion , json-render-shadcn , json-render-shadcn-svelte , json-render-solid , json-render-svelte , json-render-tanstack-start , json-render-vue , json-render-xstate , json-render-yaml , json-render-zustand , mui-material-nextjs , pigment-css , query , sb , storybook , storybook-addon-a11y , storybook-addon-actions , storybook-addon-backgrounds , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-highlight , storybook-addon-interactions , storybook-addon-jest , storybook-addon-links , storybook-addon-mdx-gfm , storybook-addon-measure , storybook-addon-onboarding , storybook-addon-outline , storybook-addon-pseudo-states , storybook-addon-storysource , storybook-addon-themes , storybook-addon-toolbars , storybook-addon-viewport , storybook-addon-vitest , storybook-angular , storybook-angular-vite , storybook-blocks , storybook-builder-manager , storybook-builder-vite , storybook-builder-webpack5 , storybook-channels , storybook-cli , storybook-client-logger , storybook-codemod , storybook-components , storybook-core , storybook-core-common , storybook-core-events , storybook-core-server , storybook-core-webpack , storybook-csf-plugin , storybook-csf-tools , storybook-docs-tools , storybook-ember , storybook-experimental-addon-test , storybook-experimental-nextjs-vite , storybook-html , storybook-html-vite , storybook-html-webpack5 , storybook-instrumenter , storybook-manager , storybook-manager-api , storybook-nextjs , storybook-nextjs-vite , storybook-node-logger , storybook-preact , storybook-preact-vite , storybook-preact-webpack5 , storybook-preset-create-react-app , storybook-preset-html-webpack , storybook-preset-preact-webpack , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-preset-svelte-webpack , storybook-preset-vue3-webpack , storybook-preview , storybook-preview-api , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-router , storybook-server , storybook-server-webpack5 , storybook-source-loader , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-tanstack-react , storybook-telemetry , storybook-test , storybook-theming , storybook-types , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , tanstack-angular-query-experimental , tanstack-eslint-plugin-query , tanstack-preact-query-devtools , tanstack-preact-query-persist-client , tanstack-query-async-storage-persister , tanstack-query-broadcast-client-experimental , tanstack-query-persist-client-core , tanstack-query-sync-storage-persister , tanstack-react-query-devtools , tanstack-react-query-next-experimental , tanstack-react-query-persist-client , tanstack-solid-query , tanstack-solid-query-devtools , tanstack-solid-query-persist-client , tanstack-vue-query , trpc-next , use-intl , vite-plugin-storybook-nextjs , wyw-in-js , x402 , x402-aptos , x402-evm , x402-express , x402-extensions , x402-fastify , x402-hono , x402-mcp , x402-next , x402-paywall

Affected packages:

create-next-app @ 16.0.6 (+1565 more)