CVE-2026-64648 Details
Description
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
A cache confusion vulnerability has been identified in Next.js, a React framework for full-stack web applications. This issue affects versions 12.0.0 through 15.5.20, as well as 16.0.0 through 16.2.10. The vulnerability arises when a server-side fetch request includes a body and a different initialization than the one provided to the fetch. In such cases, the response body may be incorrectly cached and returned from a different request to the same URL, but with a different body. This could lead to the unintentional leakage of confidential data from the POST response body to unauthorized requests. Notably, the requests themselves are not deduplicated, allowing this cache confusion to occur.
Users can upgrade to Next.js versions 15.5.21 or 16.2.11, both of which include the necessary fix. Instructions for downloading these versions are available on the Next.js GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-524 | Use of Cache Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | >= 12.0.0, < 15.5.21 >= 16.0.0, < 16.2.11 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | Initial Analysis | [email protected] |
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |