Next.js, a React framework for full‑stack web applications, has a cache‑poisoning flaw in versions 15.0.0 through 15.5.26 and 16.0.0 through 16.3.7. The bug allows a request to the response cache to be keyed without sufficient binding to the source route, meaning an attacker can craft a request that replaces a page’s cache entry with content from a different route. The poisoned cache entry can then be served to every visitor until the entry is revalidated or purged, effectively compromising the integrity of the content delivered by the application and potentially misleading users or exposing sensitive information.

Self‑hosted Next.js deployments that use the Pages Router for statically generated or Incremental Static Regeneration pages and run any version from 15.0.0 through 15.5.26 or from 16.0.0 through 16.3.7 are affected; applications hosted on Vercel remain secure. The issue is fixed in Next.js 15.5.27 and 16.3.8, and all later releases are not vulnerable.

The CVSS base score of 6.3 indicates moderate severity; the EPSS score is not available, so exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a crafted HTTP request to a cached route; no authentication is required. Once the cache entry is poisoned, the incorrect content is served to all users of the compromised page until the cache is purged or revalidated, giving the attacker a broad and persistent impact.