AIKIDO-2026-683913
next is vulnerable to Cache Poisoning
63
Medium Risk
This Affects:
nextTL;DR
Self hosted next Pages Router apps store SSG and ISR responses in a shared cache keyed from the /_next/data path. The path match ignores letter case, so a request for another casing of a route can replace the cached page. Later visitors receive that wrong page until the entry is revalidated. The fix matches /_next/data paths with case sensitivity.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you self host the Pages Router with SSG or ISR.
Background info
next is vulnerable to Cache Poisoning in versions 15.0.0 - 15.5.26 and 16.0.0 - 16.3.7.
How to fix this
Upgrade the next library to the patch version.
Links
GitHub Releases
Fix Commits
github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.