CVE-2026-64647 in Next.js
Summary
by MITRE • 07/27/2026
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability affects Next.js applications running within specific version ranges, creating a critical cache poisoning scenario that enables unauthorized data leakage through server-side fetching mechanisms. The flaw manifests when the framework processes fetch requests containing request bodies with content types using character encodings other than UTF-8, particularly affecting UTF-16 encoded sequences where different byte representations can map to identical cache keys. The vulnerability stems from inadequate cache key generation logic that fails to account for the full request body content when determining cache uniqueness, creating a situation where multiple requests to the same endpoint with different payloads but identical cache keys will return cached responses from previous requests.
The technical implementation of this vulnerability operates at the application layer, specifically within Next.js's server-side rendering and data fetching capabilities. When a fetch operation occurs with a POST request containing a body in non-UTF-8 encoding, the framework's caching mechanism generates cache keys based on URL and method alone rather than incorporating the complete request body content. This creates a race condition where subsequent requests with different payloads but similar byte sequences will retrieve cached responses from previous requests, potentially exposing sensitive data to unauthorized users who can construct requests that map to existing cache entries.
The operational impact of this vulnerability represents a significant information disclosure threat within web applications built on Next.js frameworks. Attackers can exploit this weakness by crafting POST requests with specific UTF-16 byte sequences that will collide in the caching system, thereby accessing cached responses containing confidential information from other users or system processes. This creates a scenario where sensitive data such as user credentials, personal information, financial records, or system responses could be inadvertently exposed to unauthorized parties without proper access controls being triggered.
Security implications of this vulnerability align with CWE-200 (Information Exposure) and CWE-254 (Weaknesses in Cache Design) classifications, while also mapping to ATT&CK techniques involving credential access through information disclosure. The vulnerability particularly affects applications that process sensitive data through server-side fetching operations, where the caching mechanism becomes a vector for cross-request data leakage. Organizations using affected Next.js versions should prioritize immediate patching to versions 15.5.21 or 16.2.11, as these releases contain the necessary fixes that ensure cache keys incorporate complete request body content regardless of character encoding. Additional mitigations include implementing proper input validation and sanitization for all request bodies, monitoring for unusual cache behavior patterns, and considering application-level caching controls that prevent automatic response caching for sensitive endpoints until the vulnerability is fully addressed through version updates.
This issue demonstrates the critical importance of proper cache key generation in web frameworks, where seemingly minor implementation details can create substantial security risks. The vulnerability specifically targets UTF-16 encoded content but could potentially affect other non-UTF-8 encodings that produce similar byte sequence collisions in the caching system. Organizations should conduct thorough security assessments of their Next.js applications to identify any custom fetch implementations or middleware that might be susceptible to similar cache poisoning scenarios, and ensure all development teams understand the implications of character encoding handling in server-side request processing.