The version of Next.js installed on the remote host is 15.0.0 prior to 15.5.27 or 16.0.0 prior to 16.3.8. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in the Image Optimization API, where an attacker-controlled, allow-listed remote URL can lead to requests to private IP addresses. This issue only affects versions 16.0.0 and later. (CVE-2026-94483)

- A cache poisoning vulnerability in self-hosted applications using the Pages Router with SSG or ISR pages, allowing a page's cache entry to be replaced with content from a different route. (CVE-2026-94543)

- A cache poisoning vulnerability in applications using a root-level catch-all page together with SSG or ISR routes, leading to cross-user content substitution and persistent denial of service. (CVE-2026-94484)

- An information disclosure vulnerability in App Router metadata image routes built with webpack, which ignore the 'dynamicParams' route segment option. (CVE-2026-94485)

- An information disclosure vulnerability where pending 'use cache' fills are shared between Draft Mode and regular requests, leaking unpublished content. This issue only affects versions 16.0.0 and later. (CVE-2026-94544)

- A cache leak across root param values in nested 'use cache' functions when Cache Components are enabled. This issue only affects versions 16.0.0 and later. (CVE-2026-103004)

- An information disclosure vulnerability in the development server's Model Context Protocol endpoint, which does not verify the request origin. This issue only affects versions 16.0.0 and later. (CVE-2026-94486)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and
    16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static
    Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route.
    A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or
    persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in
    versions 15.5.27 and 16.3.8. (CVE-2026-94484)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Next.js 是一個用於構建全棧 Web 應用程序的 React 框架。從 15.0.0 until 15.5.27 和 16.3.8，具有根層次 catch-all 頁面及靜態產生或增量靜態再生路徑的應用程式可以使用來源路由範圍不足的共用回應快取金鑰。
    單一未經驗證的特製要求可能會毒害該快取，導致跨使用者內容替代或持續拒絕服務，直到重新驗證或取代中毒項目為止。此問題已在 15.5.27 和 16.3.8 版中修正。(CVE-2026-94484)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Next.js 是用于构建全栈 Web 应用程序的 React 框架。从 15.0.0 until 15.5.27 和 16.3.8，具有根级捕获页面和静态生成或增量静态重新生成路由的应用程序可以使用源路由范围不足的共享响应缓存密钥。
    单个未经身份验证的特制请求可使该缓存中毒，从而导致跨用户内容替换或持续拒绝服务，直到中毒条目重新验证或替换为止。此问题已在 15.5.27 和 16.3.8 版本中得到修补。(CVE-2026-94484)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Next.js は、フルスタックの Web アプリケーションを構築するための React フレームワークです。15.0.0から15.5.27および16.3.8まで、ルートレベルのキャッチオールページと静的に生成されたルートまたは増分静的再生成ルートを持つアプリケーションは、ソースルートに対して十分に有効範囲が設定されていない共有応答キャッシュキーを使用できます。
    認証されていない細工された単一のリクエストがそのキャッシュを汚染し、クロスユーザーコンテンツの置き換え、または有害なエントリが再検証または置換されるまで持続的なサービス拒否を引き起こす可能性があります。この問題はバージョン 15.5.27および 16.3.8で修正されています。(CVE-2026-94484)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and     16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static     Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route.
    A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or     persistent denial of service until the poisoned entry is revalidated or replaced. This issue is fixed in     versions 15.5.27 and 16.3.8. (CVE-2026-94484)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
115751	Next.js 15.x < 15.5.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
115752	Next.js 16.0.x < 16.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2026/11/6	2026/11/6	high
473800	SCA: security update for next (GHSA-mcj8-r9mp-w47p)	Tenable Cloud Security	SCA Checks	2026/10/8	2026/10/8	medium
473934	Chainguard: keep-ui-fips: security update to 0.54.3-r6	Tenable Cloud Security	Chainguard Local Security Checks	2026/10/9	2026/10/9	medium
473995	Echo: next: security update to 15.5.27	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/9	2026/10/13	medium
473800	SCA: security update for next (GHSA-mcj8-r9mp-w47p)	Tenable Self-Hosted Container Security	SCA Checks	2026/10/8	2026/10/8	medium
473934	Chainguard: keep-ui-fips: security update to 0.54.3-r6	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	2026/10/9	2026/10/9	medium
473995	Echo: next: security update to 15.5.27	Tenable Cloud Security	Echo Local Security Checks	2026/10/9	2026/10/13	medium
362695	Linux Distros 未修補弱點：CVE-2026-94484	Nessus	Misc.	2026/10/2	2026/11/9	medium
362695	Linux Distros 未修补的漏洞：CVE-2026-94484	Nessus	Misc.	2026/10/2	2026/11/9	medium
362695	Linux Distros のパッチ未適用の脆弱性: CVE-2026-94484	Nessus	Misc.	2026/10/2	2026/11/9	medium
362695	Linux Distros Unpatched Vulnerability : CVE-2026-94484	Nessus	Misc.	2026/10/2	2026/11/9	medium

検出

プラグインの検索

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium