{"items":[{"id":"NVI-00011786","kind":"vulnerability","title":"Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3w37-wq28-93x7","CVE-2026-94544"],"plain_summary":"GitHub lists this reviewed advisory for next. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2b8f5f2c216ae55137ff71b8bb8a587c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T20:32:15.000Z","value":"4.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2b8f5f2c216ae55137ff71b8bb8a587c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2b8f5f2c216ae55137ff71b8bb8a587c","url":"https://github.com/advisories/GHSA-3w37-wq28-93x7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3w37-wq28-93x7","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:38.867Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2b8f5f2c216ae55137ff71b8bb8a587c"],"technology":"next","known_exclusions":[],"conditions_summary":"Pending `use cache` fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill:\n\n- A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication.\n- A Draft Mode request that overlaps a regular request receives published content instead of the draft.\n\nIf the overlapping regular request prerenders a page — for example an on-demand prerender of a route that was not prerendered at build time — the unpublished content can be persisted into the generated page and served to all later visitors of that route until the page is revalidated. Since cached functions can be shared across routes, the poisoned page does not need to be the page the editor is previewing.\n\nSites are affected if they enable Cache Components (or `experimental.useCache`) and serve Draft Mode previews whose cached functions return draft-dependent content.","public_affected_ranges":[">= 16.3.0, < 16.3.8"]}],"null_published_at":"2026-11-01T01:03:56.604Z","source_updated_at":"2026-10-07T20:32:15.000Z","source_disclosed_at":"2026-10-07T20:32:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:38.867Z"}],"next_cursor":null,"snapshot_revision":"42594"}