CVE Next.js Unstable Cache Object Argument Collision - Cache Poisoning PoC

Ethan Andrews@eandrews

•updated Jul 1, 2026•1•0•4

Detects evidence of successful cache poisoning exploitation in Next.js applications by identifying specific marker files ('VULNERABILITY_CONFIRMED.marker' and 'evidence.json') created in conjunction with active 'next start' or 'next build' processes. This pattern aligns with Proof of Concept (PoC) code targeting object argument collisions.