Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses.
MediumGHSA-pc58-hwjq-p385CVE-2026-1193483 Nov · today
Does it affect you?
0/4All must holdTicks stay in this browser
Timeline
3 Nov27 minfrom publication to Patchwire
- Published by the maintainer in vercel/next.js3 Nov, 18:39 UTC
- Seen by Patchwire +27 min3 Nov, 19:06 UTC
- Not in the GitHub database 26 min later3 Nov, 19:06 UTC
next16.0.0
Related alerts(8)
Same packagesExploitable only if · read by Claude, the source remains the reference
- Next.js application uses Edge runtime routes (App Router route handlers or Pages Router Edge API routes).
- Cookies are set through NextResponse on those Edge runtime routes.
- A sensitive HttpOnly cookie (e.g., a session token) is set on an affected response.
- Affected
- next >=16.0.0 <=16.4.2 · next >=15.0.0 <=15.5.28
- Fixed in
- after 16.4.2 · after 15.5.28
- ID
- GHSA-f3mh-rxg3-f5g2
Exploitable only if · read by Claude, the source remains the reference
- Next.js application is self-hosted.
- Next.js image optimizer (next/image) is in use.
- dangerouslyAllowSVG is false (the default).
- Affected
- next >=16.0.0 <=16.4.2 · next >=15.0.0 <=15.5.28
- Fixed in
- after 16.4.2 · after 15.5.28
- ID
- GHSA-7qx7-33qx-rqx2
Exploitable only if · read by Claude, the source remains the reference
- Next.js App Router application.
- Uses the use cache directive on functions.
- Binary arguments (such as Uint8Array or Blob values) are passed to functions using use cache.
- Affected
- next >=16.0.0 <=16.4.2
- Fixed in
- after 16.4.2
- ID
- GHSA-rhh4-g77r-r9qj
Exploitable only if · read by Claude, the source remains the reference
- Next.js built with cacheComponents: true and partialPrefetching unset or false.
- Application is self-hosted and served with next start.
- A dynamic route has a prerenderable param (generateStaticParams) whose requested value was not generated at build time.
- At least two never-prerenderable params sit below it: a layout reads the shallower one inside a Suspense boundary, and a deeper one can be supplied by the request as the placeholder.
- The route uses a blocking fallback shell.
- Affected
- next >=16.4.0
- Fixed in
- none found
- ID
- GHSA-vvgp-ww4w-46vf
Exploitable only if · read by Claude, the source remains the reference
- Cache Components is enabled.
- An outer 'use cache' function calls an inner 'use cache' function.
- The inner 'use cache' function reads a root param via next/root-params.
- The inner function returns a value that still contains pending promises (e.g. an object with immediately ready data alongside slower data).
- Affected
- next >=16.2.0
- Fixed in
- 16.4.2
- ID
- GHSA-vc7v-qv4w-wrv8
Exploitable only if · read by Claude, the source remains the reference
- Next.js application uses 'use cache'.
- The same 'use cache' function is called both directly during rendering and through unstable_cache().
- That 'use cache' function reads a root param (route parameter of the root layout).
- An unstable_cache() request arrives while the function's first fill after a cold process start is still in flight.
- Affected
- next >=16.3.0
- Fixed in
- none found
- ID
- GHSA-mfr8-8qww-v76h
Exploitable only if · read by Claude, the source remains the reference
- Project uses Next.js (affected versions and conditions not yet disclosed).
- Affected
- in the source
- Fixed in
- none found
- ID
- WATCH-next-upcoming-nextjs-security-release-november-2026
Exploitable only if · read by Claude, the source remains the reference
- Next.js application uses the App Router.
- Application defines at least one Server Action.
- Application is running a version of Next.js affected by this advisory (not yet upgraded to a patched release).
- Affected
- next >=13.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0
- Fixed in
- 16.4.1 · 15.5.28
- ID
- GHSA-p3m5-59mp-jv5r