Cache poisoning of SSG and ISR pages in self-hosted Next.js applications.
Does it affect you?
Timeline
30 Sep- Published by GitHub advisory30 Sep
- Seen by Patchwire23 Oct
- Fix released30 Sep
Versions of next
Related alerts(8)
Same packages- Next.js application uses the App Router.
- Application defines at least one Server Action.
- Next.js version is an unpatched (vulnerable) release.
- Affected
- next >=13.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0
- Fixed in
- 15.5.28 · 16.4.1
- ID
- GHSA-p3m5-59mp-jv5r
Source summary
Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
- Affected
- next >=16.0.0 <=16.4.0
- Fixed in
- 16.4.1
- ID
- GHSA-673q-mjm6-r5xr
Source summary
Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5 . Fresh installs automatically get a fixed version fo sharp . Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.
- Affected
- next >=10.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0
- Fixed in
- 15.5.28 · 16.4.1
- ID
- GHSA-2464-fhr4-w9xw
- Project uses Next.js.
- Project depends on the affected upstream dependencies that Next.js plans to patch in the October 14, 2026 out-of-band security update.
- Affected
- in the source
- Fixed in
- no fix yet
- ID
- WATCH-next-upcoming-nextjs-security-update-october-2026
- Next.js Image Optimization is in use.
- images.remotePatterns is configured with at least one allow-listed remote host.
- An allow-listed remote host's DNS entries can be controlled by an attacker (e.g., resolving to private IPs).
- Affected
- next >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
- ID
- GHSA-cjq9-62q9-8jv4
- Next.js App Router application.
- Application is built with webpack.
- Uses metadata image routes such as opengraph-image or twitter-image within dynamic segments.
- Route segment sets dynamicParams to restrict params to those returned by generateStaticParams().
- Affected
- next >=16.0.0 <16.3.8
- Fixed in
- 16.3.8
- ID
- GHSA-f87g-xv8r-7p7x
Source summary
Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication. - A Draft Mode request that overlaps a regular request receives published content instead of the draft. If the overlapping regular request prerenders a page: for example an on-demand prerender of a route that was not prerendered at build time: the unpubli
- Affected
- next >=16.3.0 <16.3.8
- Fixed in
- 16.3.8
- ID
- GHSA-3w37-wq28-93x7
- Next.js with Cache Components enabled (cacheComponents: true).
- A 'use cache' function calls another 'use cache' function.
- The inner 'use cache' function reads a root param.
- The app uses root params with multiple distinct values served from the same cached entry.
- Affected
- next >=16.3.0 <16.3.8
- Fixed in
- 16.3.8
- ID
- GHSA-h694-7cp9-m8p3