The vulnerability is that Next.js from 15.0.0 through 15.5.27 and 16.3.8 uses an insufficiently scoped shared response cache key for applications with a root-level catch‑all page and statically generated or ISR routes. An unauthenticated attacker can craft a request that poisons this cache key, causing the application to serve data belonging to another user or to refuse to serve content until the cache entry is revalidated. The flaw allows cross‑user content substitution or persistent denial of service, which can impact confidentiality and availability.

Affected systems are installations of Vercel’s Next.js framework, specifically versions 15.0.0 up to and including 15.5.27 and the 16.3.8 release. The issue occurs in any setup that employs a root-level catch‑all page alongside static site generation or incremental static regeneration. The problem is resolved in 15.5.27 and 16.3.8.

Risk assessment: The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, but the lack of a KEV listing suggests no known exploitation on a wide scale yet. Nonetheless, since the exploit requires only an unauthenticated HTTP request targeting an otherwise public route, it is likely to be reachable by attackers. The vulnerability can lead to persistent denial of service until the cache is refreshed and can expose one user's content to another, potentially violating data confidentiality for some applications.