Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-27T19:20:42 next: Next.js: Information disclosure via server-side fetch cache 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-524

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.

A flaw was found in Next.js. A remote attacker could exploit a vulnerability in the server-side fetch mechanism, where a request with a body might receive a cached response intended for a different request to the same URL but different body. This could lead to the unauthorized disclosure of confidential data from POST request response bodies to an unprivileged user.

This Important information disclosure flaw in Next.js arises from a server-side fetch cache confusion, potentially leaking confidential data from POST response bodies to unauthorized requests. The vulnerability is triggered by specific unsafe fetch patterns where the request object's initialization differs from the fetch call's initialization. Red Hat customers using Next.js applications should review their fetch implementations, noting that applications built with Pages Router are not impacted. Red Hat Enterprise Linux 10 Affected firefox Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 7 Affected firefox Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected firefox Red Hat Enterprise Linux 9 Affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Trusted Artifact Signer Not affected rhtas/rekor-search-ui-rhel9 streams for Apache Kafka 2 Affected next streams for Apache Kafka 3 Affected next https://www.cve.org/CVERecord?id=CVE-2026-64648 https://nvd.nist.gov/vuln/detail/CVE-2026-64648 https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a https://github.com/vercel/next.js/releases/tag/v15.5.21 https://github.com/vercel/next.js/releases/tag/v16.2.11 https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742