CVE-2026-64647 Details
Description
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.
A vulnerability exists in Vercel Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. When a server-side fetch request includes a body with a content type charset other than UTF-8, the response may be cached in a way that allows data to leak between requests. This means that confidential information from one POST response could be exposed to an unauthorized request to the same URL, provided the bodies are different but the cache key collision occurs. This issue does not affect applications using the Pages Router.
Users can upgrade to Next.js versions 15.5.21 or 16.2.11, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082 | [email protected] | Patch |
| https://github.com/vercel/next.js/pull/96008 | [email protected] | Issue TrackingPatch |
| https://github.com/vercel/next.js/releases/tag/v15.5.21 | [email protected] | ProductRelease Notes |
| https://github.com/vercel/next.js/releases/tag/v16.2.11 | [email protected] | ProductRelease Notes |
| https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 13.0.0, < 15.5.21 >= 16.0.0, < 16.2.11 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | Initial Analysis | [email protected] |
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |