Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments.
MediumGHSA-rhh4-g77r-r9qjCVE-2026-1193493 Nov · today
Does it affect you?
0/3All must holdTicks stay in this browser
Timeline
3 Nov27 minfrom publication to Patchwire
- Published by the maintainer in vercel/next.js3 Nov, 18:39 UTC
- Seen by Patchwire +27 min3 Nov, 19:06 UTC
- Not in the GitHub database 27 min later3 Nov, 19:06 UTC
nextafter 16.4.2
Related alerts(8)
Same packagesExploitable only if · read by Claude, the source remains the reference
- Next.js application uses Edge runtime routes (App Router route handlers or Pages Router Edge API routes).
- Cookies are set through NextResponse on those Edge runtime routes.
- A sensitive HttpOnly cookie (e.g., a session token) is set on an affected response.
- Affected
- next >=16.0.0 <=16.4.2 · next >=15.0.0 <=15.5.28
- Fixed in
- after 16.4.2 · after 15.5.28
- ID
- GHSA-f3mh-rxg3-f5g2
Exploitable only if · read by Claude, the source remains the reference
- Next.js application is self-hosted.
- Next.js image optimizer (next/image) is in use.
- dangerouslyAllowSVG is false (the default).
- Affected
- next >=16.0.0 <=16.4.2 · next >=15.0.0 <=15.5.28
- Fixed in
- after 16.4.2 · after 15.5.28
- ID
- GHSA-7qx7-33qx-rqx2
Exploitable only if · read by Claude, the source remains the reference
- Next.js application is self-hosted.
- Uses App Router route handlers or the fetch cache that return a fetched upstream response unchanged.
- Application sits behind an HTTP/1.1 reverse proxy that permits pipelined response queueing.
- An attacker can supply or influence a crafted upstream response.
- Affected
- next >=16.0.0 · next <16.0.0
- Fixed in
- 16.0.0
- ID
- GHSA-pc58-hwjq-p385
Exploitable only if · read by Claude, the source remains the reference
- Next.js built with cacheComponents: true and partialPrefetching unset or false.
- Application is self-hosted and served with next start.
- A dynamic route has a prerenderable param (generateStaticParams) whose requested value was not generated at build time.
- At least two never-prerenderable params sit below it: a layout reads the shallower one inside a Suspense boundary, and a deeper one can be supplied by the request as the placeholder.
- The route uses a blocking fallback shell.
- Affected
- next >=16.4.0
- Fixed in
- none found
- ID
- GHSA-vvgp-ww4w-46vf
Exploitable only if · read by Claude, the source remains the reference
- Cache Components is enabled.
- An outer 'use cache' function calls an inner 'use cache' function.
- The inner 'use cache' function reads a root param via next/root-params.
- The inner function returns a value that still contains pending promises (e.g. an object with immediately ready data alongside slower data).
- Affected
- next >=16.2.0
- Fixed in
- 16.4.2
- ID
- GHSA-vc7v-qv4w-wrv8
Exploitable only if · read by Claude, the source remains the reference
- Next.js application uses 'use cache'.
- The same 'use cache' function is called both directly during rendering and through unstable_cache().
- That 'use cache' function reads a root param (route parameter of the root layout).
- An unstable_cache() request arrives while the function's first fill after a cold process start is still in flight.
- Affected
- next >=16.3.0
- Fixed in
- none found
- ID
- GHSA-mfr8-8qww-v76h
Exploitable only if · read by Claude, the source remains the reference
- Project uses Next.js (affected versions and conditions not yet disclosed).
- Affected
- in the source
- Fixed in
- none found
- ID
- WATCH-next-upcoming-nextjs-security-release-november-2026
Exploitable only if · read by Claude, the source remains the reference
- Next.js application uses the App Router.
- Application defines at least one Server Action.
- Application is running a version of Next.js affected by this advisory (not yet upgraded to a patched release).
- Affected
- next >=13.0.0 <=15.5.27 · next >=16.0.0 <=16.4.0
- Fixed in
- 16.4.1 · 15.5.28
- ID
- GHSA-p3m5-59mp-jv5r