Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-27T19:11:28 next: Next.js: Information disclosure via server-side request caching 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-524

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.

A flaw was found in Next.js. This vulnerability allows a remote attacker to potentially access confidential data. When a server-side fetch processes a request with a body using a non-UTF-8 character set, it may incorrectly return a cached response body from a different request to the same URL but different body. This can lead to the unauthorized disclosure of sensitive information.

This Low impact information disclosure flaw affects Next.js applications where server-side fetches handle request bodies with non-UTF-8 charsets. Under these specific conditions, cached responses containing confidential data could be inadvertently exposed to unauthorized requests. Red Hat Enterprise Linux 10 Fix deferred firefox Red Hat Enterprise Linux 10 Fix deferred thunderbird Red Hat Enterprise Linux 7 Fix deferred firefox Red Hat Enterprise Linux 8 Fix deferred firefox Red Hat Enterprise Linux 8 Fix deferred thunderbird Red Hat Enterprise Linux 9 Fix deferred firefox Red Hat Enterprise Linux 9 Fix deferred thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/disk-image-cuda-rhel9 Red Hat Trusted Artifact Signer Fix deferred rhtas/rekor-search-ui-rhel9 streams for Apache Kafka 2 Out of support scope next streams for Apache Kafka 3 Fix deferred next https://www.cve.org/CVERecord?id=CVE-2026-64647 https://nvd.nist.gov/vuln/detail/CVE-2026-64647 https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082 https://github.com/vercel/next.js/pull/96008 https://github.com/vercel/next.js/releases/tag/v15.5.21 https://github.com/vercel/next.js/releases/tag/v16.2.11 https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q