{"id":"CVE-2026-64648","aliases":["CLSA-2026-1786538556","CLSA-2026-1787663916","CLSA-2026-1791901908","CLSA-2026-1792195748","CLSA-2026-1792195753","CLSA-2026-1792196877","CLSA-2026-1792196880","CLSA-2026-1792206303","CLSA-2026-1792206307","CLSA-2026-1792272243","CLSA-2026-1792272248","CLSA-2026-1792293003","CLSA-2026-1792293014","CLSA-2026-1792304721","CLSA-2026-1792304743","CLSA-2026-1792326296","CLSA-2026-1792326306","CLSA-2026-1792338236","CLSA-2026-1792338239","CLSA-2026-1792346492","CLSA-2026-1792358597","CLSA-2026-1792358600","CLSA-2026-1792364003","CLSA-2026-1792364007","CLSA-2026-1792367395","EUVD-2026-49565","GHSA-2xp9-vwfh-vxw4","GHSA-68g3-v927-f742","GHSA-mwv6-3258-q52c","GHSA-w37m-7fhw-fmv9","ROOT-APP-NPM-CVE-2026-64648","ROOT-APP-NPM-GHSA-mwv6-3258-q52c"],"status":"published","title":"Next.js: Response Body Cache Confusion for Requests Containing Bodies","description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a  server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00374,"percentile":0.31582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-400","CWE-497","CWE-502","CWE-524"],"published":"2025-12-11T22:49:27Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["15.5.21","16.2.11","14.2.34","15.0.6","15.1.10","15.2.7","15.3.7","15.4.9","15.5.8","15.6.0-canary.59","16.0.9","16.1.0-canary.17"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["15.5.21-aikido.1","16.2.11-aikido.1","16.2.11-aikido.2","15.5.21-aikido.2","14.2.33-aikido.2","14.2.32-aikido.4","14.2.30-aikido.7","14.2.26-aikido.6","14.2.26-aikido.4","14.2.30-aikido.10","13.4.19-aikido.6","13.4.19-aikido.7","14.2.10-aikido.3","14.2.13-aikido.3","14.2.3-aikido.1","14.2.15-aikido.4","14.0.4-aikido.9","14.1.3-aikido.2","14.2.25-aikido.2","14.1.0-aikido.4","14.2.18-aikido.2","13.3.0-aikido.5","14.2.15-aikido.3","13.4.19-aikido.3","14.1.0-aikido.7","14.1.0-aikido.8","14.2.13-aikido.1","14.2.3-aikido.5","14.2.0-aikido.2","14.0.3-aikido.3","14.2.5-aikido.9","14.2.5-aikido.10","14.2.2-aikido.7","14.2.33-aikido.1","14.1.3-aikido.5","14.2.29-aikido.1","14.2.29-aikido.5","14.2.31-aikido.2","14.2.18-aikido.1","14.0.0-aikido.7","14.2.10-aikido.4","14.2.13-aikido.4","14.2.10-aikido.2","14.2.18-aikido.6","14.2.21-aikido.6","14.2.16-aikido.6","14.2.25-aikido.1","14.2.0-aikido.6","14.2.31-aikido.5","14.2.0-aikido.5","14.2.2-aikido.9","14.2.30-aikido.8","14.2.24-aikido.7","14.0.3-aikido.6","14.2.32-aikido.5","14.2.33-aikido.3","14.0.0-aikido.5","14.2.3-aikido.3","13.5.4-aikido.5","14.1.3-aikido.6","13.3.0-aikido.6","14.0.3-aikido.4","14.2.13-aikido.2","14.2.21-aikido.4","14.0.0-aikido.3","14.1.4-aikido.7","14.2.21-aikido.2","13.3.0-aikido.2","14.2.16-aikido.2","14.2.16-aikido.4","13.5.4-aikido.2","13.3.0-aikido.7","14.2.33-aikido.4","14.2.26-aikido.3","14.0.3-aikido.5","14.2.30-aikido.9","14.1.4-aikido.8","14.2.32-aikido.6","13.5.4-aikido.6","14.1.3-aikido.7","14.2.16-aikido.5","14.0.0-aikido.6","14.2.21-aikido.5","14.2.3-aikido.4","14.2.2-aikido.8","13.4.19-aikido.4","14.2.15-aikido.5","14.2.3-aikido.2","13.5.6-aikido.4","14.2.28-aikido.5","14.2.32-aikido.2","14.1.4-aikido.9","14.1.3-aikido.1","13.3.0-aikido.3","14.2.32-aikido.7","13.5.6-aikido.5","14.2.15-aikido.6","14.1.3-aikido.8","14.2.32-aikido.8","14.2.29-aikido.4","14.2.28-aikido.1","14.2.33-aikido.5","13.5.6-aikido.6","14.2.26-aikido.5","14.2.28-aikido.2","14.2.26-aikido.2","14.0.4-aikido.8","14.2.28-aikido.3","14.1.0-aikido.2","14.2.31-aikido.3","14.2.24-aikido.6","14.1.4-aikido.6","14.2.18-aikido.3","13.3.0-aikido.4","14.1.0-aikido.5","14.2.16-aikido.3","14.0.0-aikido.4","14.1.0-aikido.3","14.2.18-aikido.4","13.5.4-aikido.3","14.2.31-aikido.1","14.2.0-aikido.3","13.4.19-aikido.5","14.2.31-aikido.4","14.2.29-aikido.2","14.2.0-aikido.1","13.5.4-aikido.4","14.2.21-aikido.1","14.2.16-aikido.1","14.1.3-aikido.3","13.3.0-aikido.8","14.2.21-aikido.3","14.2.32-aikido.3","14.2.29-aikido.3","13.5.11-aikido.9","14.1.3-aikido.4","14.2.0-aikido.4","14.2.30-aikido.6","14.2.28-aikido.4","14.2.33-aikido.6","14.1.0-aikido.6","14.2.18-aikido.5","13.5.6-aikido.7"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["15.5.21-root.io.1","16.2.11-root.io.1","16.2.11-root.io.2","15.5.21-root.io.2","14.2.33-root.io.2","14.2.32-root.io.4","14.2.30-root.io.7","14.2.26-root.io.6","14.2.26-root.io.4","14.2.30-root.io.10","13.4.19-root.io.6","13.4.19-root.io.7","14.2.10-root.io.3","14.2.13-root.io.3","14.2.3-root.io.1","14.2.15-root.io.4","14.0.4-root.io.9","14.1.3-root.io.2","14.2.25-root.io.2","14.1.0-root.io.4","14.2.18-root.io.2","13.3.0-root.io.5","14.2.15-root.io.3","13.4.19-root.io.3","14.1.0-root.io.7","14.1.0-root.io.8","14.2.13-root.io.1","14.2.3-root.io.5","14.2.0-root.io.2","14.0.3-root.io.3","14.2.5-root.io.9","14.2.5-root.io.10","14.2.2-root.io.7","14.2.33-root.io.1","14.1.3-root.io.5","14.2.29-root.io.1","14.2.29-root.io.5","14.2.31-root.io.2","14.2.18-root.io.1","14.0.0-root.io.7","14.2.10-root.io.4","14.2.13-root.io.4","14.2.10-root.io.2","14.2.18-root.io.6","14.2.21-root.io.6","14.2.16-root.io.6","14.2.25-root.io.1","14.2.0-root.io.6","14.2.31-root.io.5","14.2.0-root.io.5","14.2.2-root.io.9","14.2.30-root.io.8","14.2.24-root.io.7","14.0.3-root.io.6","14.2.32-root.io.5","14.2.33-root.io.3","14.0.0-root.io.5","14.2.3-root.io.3","13.5.4-root.io.5","14.1.3-root.io.6","13.3.0-root.io.6","14.0.3-root.io.4","14.2.13-root.io.2","14.2.21-root.io.4","14.0.0-root.io.3","14.1.4-root.io.7","14.2.21-root.io.2","13.3.0-root.io.2","14.2.16-root.io.2","14.2.16-root.io.4","13.5.4-root.io.2","13.3.0-root.io.7","14.2.33-root.io.4","14.2.26-root.io.3","14.0.3-root.io.5","14.2.30-root.io.9","14.1.4-root.io.8","14.2.32-root.io.6","13.5.4-root.io.6","14.1.3-root.io.7","14.2.16-root.io.5","14.0.0-root.io.6","14.2.21-root.io.5","14.2.3-root.io.4","14.2.2-root.io.8","13.4.19-root.io.4","14.2.15-root.io.5","14.2.3-root.io.2","13.5.6-root.io.4","14.2.28-root.io.5","14.2.32-root.io.2","14.1.4-root.io.9","14.1.3-root.io.1","13.3.0-root.io.3","14.2.32-root.io.7","13.5.6-root.io.5","14.2.15-root.io.6","14.1.3-root.io.8","14.2.32-root.io.8","14.2.29-root.io.4","14.2.28-root.io.1","14.2.33-root.io.5","13.5.6-root.io.6","14.2.26-root.io.5","14.2.28-root.io.2","14.2.26-root.io.2","14.0.4-root.io.8","14.2.28-root.io.3","14.2.24-root.io.6","14.1.0-root.io.2","14.2.31-root.io.3","14.1.4-root.io.6","14.2.18-root.io.3","13.3.0-root.io.4","14.1.0-root.io.5","14.2.16-root.io.3","14.0.0-root.io.4","14.1.0-root.io.3","14.2.18-root.io.4","13.5.4-root.io.3","14.2.31-root.io.1","14.2.0-root.io.3","13.4.19-root.io.5","14.2.31-root.io.4","14.2.29-root.io.2","14.2.0-root.io.1","13.5.4-root.io.4","14.2.21-root.io.1","14.1.3-root.io.3","14.2.16-root.io.1","13.3.0-root.io.8","14.2.21-root.io.3","14.2.32-root.io.3","14.2.29-root.io.3","13.5.11-root.io.9","14.1.3-root.io.4","14.2.0-root.io.4","14.2.30-root.io.6","14.2.33-root.io.6","14.2.28-root.io.4","14.1.0-root.io.6","13.5.6-root.io.7","14.2.18-root.io.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"15.5.21"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.2.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"14.2.34"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-next-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/eslint-plugin-next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/bundle-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/plugin-storybook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/polyfill-nomodule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/react-refresh-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/third-parties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.2-tuxcare.0"},{"fixed":"15.1.2-tuxcare.3"}]}],"versions":["15.1.2","15.1.2-tuxcare.1","15.1.2-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/codemod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.2.35-tuxcare.0"},{"fixed":"14.2.35-tuxcare.6"}]}],"versions":["14.2.35","14.2.35-tuxcare.4","14.2.35-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/mdx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.5.11-tuxcare.0"},{"fixed":"13.5.11-tuxcare.16"}]}],"versions":["13.5.11","13.5.11-tuxcare.13","13.5.11-tuxcare.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@next/swc-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.1.2-tuxcare.0"},{"fixed":"15.1.2-tuxcare.3"}]}],"versions":["15.1.2","15.1.2-tuxcare.1","15.1.2-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"15.5.21"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.2.11"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"13.3.0"},{"fixed":"14.2.34"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.0.0-canary.0"},{"fixed":"15.0.6"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.1.1-canary.0"},{"fixed":"15.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.2.0-canary.0"},{"fixed":"15.2.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.3.0-canary.0"},{"fixed":"15.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.4.0-canary.0"},{"fixed":"15.4.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.5.1-canary.0"},{"fixed":"15.5.8"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"15.6.0-canary.0"},{"fixed":"15.6.0-canary.59"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0-beta.0"},{"fixed":"16.0.9"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0-canary.0"},{"fixed":"16.1.0-canary.17"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.21-aikido.1"},{"fixed":"16.2.11-aikido.1"},{"fixed":"16.2.11-aikido.2"},{"fixed":"15.5.21-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.5.21-root.io.1"},{"fixed":"16.2.11-root.io.1"},{"fixed":"16.2.11-root.io.2"},{"fixed":"15.5.21-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.33-aikido.2"},{"fixed":"14.2.32-aikido.4"},{"fixed":"14.2.30-aikido.7"},{"fixed":"14.2.26-aikido.6"},{"fixed":"14.2.26-aikido.4"},{"fixed":"14.2.30-aikido.10"},{"fixed":"13.4.19-aikido.6"},{"fixed":"13.4.19-aikido.7"},{"fixed":"14.2.10-aikido.3"},{"fixed":"14.2.13-aikido.3"},{"fixed":"14.2.3-aikido.1"},{"fixed":"14.2.15-aikido.4"},{"fixed":"14.0.4-aikido.9"},{"fixed":"14.1.3-aikido.2"},{"fixed":"14.2.25-aikido.2"},{"fixed":"14.1.0-aikido.4"},{"fixed":"14.2.18-aikido.2"},{"fixed":"13.3.0-aikido.5"},{"fixed":"14.2.15-aikido.3"},{"fixed":"13.4.19-aikido.3"},{"fixed":"14.1.0-aikido.7"},{"fixed":"14.1.0-aikido.8"},{"fixed":"14.2.13-aikido.1"},{"fixed":"14.2.3-aikido.5"},{"fixed":"14.2.0-aikido.2"},{"fixed":"14.0.3-aikido.3"},{"fixed":"14.2.5-aikido.9"},{"fixed":"14.2.5-aikido.10"},{"fixed":"14.2.2-aikido.7"},{"fixed":"14.2.33-aikido.1"},{"fixed":"14.1.3-aikido.5"},{"fixed":"14.2.29-aikido.1"},{"fixed":"14.2.29-aikido.5"},{"fixed":"14.2.31-aikido.2"},{"fixed":"14.2.18-aikido.1"},{"fixed":"14.0.0-aikido.7"},{"fixed":"14.2.10-aikido.4"},{"fixed":"14.2.13-aikido.4"},{"fixed":"14.2.10-aikido.2"},{"fixed":"14.2.18-aikido.6"},{"fixed":"14.2.21-aikido.6"},{"fixed":"14.2.16-aikido.6"},{"fixed":"14.2.25-aikido.1"},{"fixed":"14.2.0-aikido.6"},{"fixed":"14.2.31-aikido.5"},{"fixed":"14.2.0-aikido.5"},{"fixed":"14.2.2-aikido.9"},{"fixed":"14.2.30-aikido.8"},{"fixed":"14.2.24-aikido.7"},{"fixed":"14.0.3-aikido.6"},{"fixed":"14.2.32-aikido.5"},{"fixed":"14.2.33-aikido.3"},{"fixed":"14.0.0-aikido.5"},{"fixed":"14.2.3-aikido.3"},{"fixed":"13.5.4-aikido.5"},{"fixed":"14.1.3-aikido.6"},{"fixed":"13.3.0-aikido.6"},{"fixed":"14.0.3-aikido.4"},{"fixed":"14.2.13-aikido.2"},{"fixed":"14.2.21-aikido.4"},{"fixed":"14.0.0-aikido.3"},{"fixed":"14.1.4-aikido.7"},{"fixed":"14.2.21-aikido.2"},{"fixed":"13.3.0-aikido.2"},{"fixed":"14.2.16-aikido.2"},{"fixed":"14.2.16-aikido.4"},{"fixed":"13.5.4-aikido.2"},{"fixed":"13.3.0-aikido.7"},{"fixed":"14.2.33-aikido.4"},{"fixed":"14.2.26-aikido.3"},{"fixed":"14.0.3-aikido.5"},{"fixed":"14.2.30-aikido.9"},{"fixed":"14.1.4-aikido.8"},{"fixed":"14.2.32-aikido.6"},{"fixed":"13.5.4-aikido.6"},{"fixed":"14.1.3-aikido.7"},{"fixed":"14.2.16-aikido.5"},{"fixed":"14.0.0-aikido.6"},{"fixed":"14.2.21-aikido.5"},{"fixed":"14.2.3-aikido.4"},{"fixed":"14.2.2-aikido.8"},{"fixed":"13.4.19-aikido.4"},{"fixed":"14.2.15-aikido.5"},{"fixed":"14.2.3-aikido.2"},{"fixed":"13.5.6-aikido.4"},{"fixed":"14.2.28-aikido.5"},{"fixed":"14.2.32-aikido.2"},{"fixed":"14.1.4-aikido.9"},{"fixed":"14.1.3-aikido.1"},{"fixed":"13.3.0-aikido.3"},{"fixed":"14.2.32-aikido.7"},{"fixed":"13.5.6-aikido.5"},{"fixed":"14.2.15-aikido.6"},{"fixed":"14.1.3-aikido.8"},{"fixed":"14.2.32-aikido.8"},{"fixed":"14.2.29-aikido.4"},{"fixed":"14.2.28-aikido.1"},{"fixed":"14.2.33-aikido.5"},{"fixed":"13.5.6-aikido.6"},{"fixed":"14.2.26-aikido.5"},{"fixed":"14.2.28-aikido.2"},{"fixed":"14.2.26-aikido.2"},{"fixed":"14.0.4-aikido.8"},{"fixed":"14.2.28-aikido.3"},{"fixed":"14.1.0-aikido.2"},{"fixed":"14.2.31-aikido.3"},{"fixed":"14.2.24-aikido.6"},{"fixed":"14.1.4-aikido.6"},{"fixed":"14.2.18-aikido.3"},{"fixed":"13.3.0-aikido.4"},{"fixed":"14.1.0-aikido.5"},{"fixed":"14.2.16-aikido.3"},{"fixed":"14.0.0-aikido.4"},{"fixed":"14.1.0-aikido.3"},{"fixed":"14.2.18-aikido.4"},{"fixed":"13.5.4-aikido.3"},{"fixed":"14.2.31-aikido.1"},{"fixed":"14.2.0-aikido.3"},{"fixed":"13.4.19-aikido.5"},{"fixed":"14.2.31-aikido.4"},{"fixed":"14.2.29-aikido.2"},{"fixed":"14.2.0-aikido.1"},{"fixed":"13.5.4-aikido.4"},{"fixed":"14.2.21-aikido.1"},{"fixed":"14.2.16-aikido.1"},{"fixed":"14.1.3-aikido.3"},{"fixed":"13.3.0-aikido.8"},{"fixed":"14.2.21-aikido.3"},{"fixed":"14.2.32-aikido.3"},{"fixed":"14.2.29-aikido.3"},{"fixed":"13.5.11-aikido.9"},{"fixed":"14.1.3-aikido.4"},{"fixed":"14.2.0-aikido.4"},{"fixed":"14.2.30-aikido.6"},{"fixed":"14.2.28-aikido.4"},{"fixed":"14.2.33-aikido.6"},{"fixed":"14.1.0-aikido.6"},{"fixed":"14.2.18-aikido.5"},{"fixed":"13.5.6-aikido.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.33-root.io.2"},{"fixed":"14.2.32-root.io.4"},{"fixed":"14.2.30-root.io.7"},{"fixed":"14.2.26-root.io.6"},{"fixed":"14.2.26-root.io.4"},{"fixed":"14.2.30-root.io.10"},{"fixed":"13.4.19-root.io.6"},{"fixed":"13.4.19-root.io.7"},{"fixed":"14.2.10-root.io.3"},{"fixed":"14.2.13-root.io.3"},{"fixed":"14.2.3-root.io.1"},{"fixed":"14.2.15-root.io.4"},{"fixed":"14.0.4-root.io.9"},{"fixed":"14.1.3-root.io.2"},{"fixed":"14.2.25-root.io.2"},{"fixed":"14.1.0-root.io.4"},{"fixed":"14.2.18-root.io.2"},{"fixed":"13.3.0-root.io.5"},{"fixed":"14.2.15-root.io.3"},{"fixed":"13.4.19-root.io.3"},{"fixed":"14.1.0-root.io.7"},{"fixed":"14.1.0-root.io.8"},{"fixed":"14.2.13-root.io.1"},{"fixed":"14.2.3-root.io.5"},{"fixed":"14.2.0-root.io.2"},{"fixed":"14.0.3-root.io.3"},{"fixed":"14.2.5-root.io.9"},{"fixed":"14.2.5-root.io.10"},{"fixed":"14.2.2-root.io.7"},{"fixed":"14.2.33-root.io.1"},{"fixed":"14.1.3-root.io.5"},{"fixed":"14.2.29-root.io.1"},{"fixed":"14.2.29-root.io.5"},{"fixed":"14.2.31-root.io.2"},{"fixed":"14.2.18-root.io.1"},{"fixed":"14.0.0-root.io.7"},{"fixed":"14.2.10-root.io.4"},{"fixed":"14.2.13-root.io.4"},{"fixed":"14.2.10-root.io.2"},{"fixed":"14.2.18-root.io.6"},{"fixed":"14.2.21-root.io.6"},{"fixed":"14.2.16-root.io.6"},{"fixed":"14.2.25-root.io.1"},{"fixed":"14.2.0-root.io.6"},{"fixed":"14.2.31-root.io.5"},{"fixed":"14.2.0-root.io.5"},{"fixed":"14.2.2-root.io.9"},{"fixed":"14.2.30-root.io.8"},{"fixed":"14.2.24-root.io.7"},{"fixed":"14.0.3-root.io.6"},{"fixed":"14.2.32-root.io.5"},{"fixed":"14.2.33-root.io.3"},{"fixed":"14.0.0-root.io.5"},{"fixed":"14.2.3-root.io.3"},{"fixed":"13.5.4-root.io.5"},{"fixed":"14.1.3-root.io.6"},{"fixed":"13.3.0-root.io.6"},{"fixed":"14.0.3-root.io.4"},{"fixed":"14.2.13-root.io.2"},{"fixed":"14.2.21-root.io.4"},{"fixed":"14.0.0-root.io.3"},{"fixed":"14.1.4-root.io.7"},{"fixed":"14.2.21-root.io.2"},{"fixed":"13.3.0-root.io.2"},{"fixed":"14.2.16-root.io.2"},{"fixed":"14.2.16-root.io.4"},{"fixed":"13.5.4-root.io.2"},{"fixed":"13.3.0-root.io.7"},{"fixed":"14.2.33-root.io.4"},{"fixed":"14.2.26-root.io.3"},{"fixed":"14.0.3-root.io.5"},{"fixed":"14.2.30-root.io.9"},{"fixed":"14.1.4-root.io.8"},{"fixed":"14.2.32-root.io.6"},{"fixed":"13.5.4-root.io.6"},{"fixed":"14.1.3-root.io.7"},{"fixed":"14.2.16-root.io.5"},{"fixed":"14.0.0-root.io.6"},{"fixed":"14.2.21-root.io.5"},{"fixed":"14.2.3-root.io.4"},{"fixed":"14.2.2-root.io.8"},{"fixed":"13.4.19-root.io.4"},{"fixed":"14.2.15-root.io.5"},{"fixed":"14.2.3-root.io.2"},{"fixed":"13.5.6-root.io.4"},{"fixed":"14.2.28-root.io.5"},{"fixed":"14.2.32-root.io.2"},{"fixed":"14.1.4-root.io.9"},{"fixed":"14.1.3-root.io.1"},{"fixed":"13.3.0-root.io.3"},{"fixed":"14.2.32-root.io.7"},{"fixed":"13.5.6-root.io.5"},{"fixed":"14.2.15-root.io.6"},{"fixed":"14.1.3-root.io.8"},{"fixed":"14.2.32-root.io.8"},{"fixed":"14.2.29-root.io.4"},{"fixed":"14.2.28-root.io.1"},{"fixed":"14.2.33-root.io.5"},{"fixed":"13.5.6-root.io.6"},{"fixed":"14.2.26-root.io.5"},{"fixed":"14.2.28-root.io.2"},{"fixed":"14.2.26-root.io.2"},{"fixed":"14.0.4-root.io.8"},{"fixed":"14.2.28-root.io.3"},{"fixed":"14.2.24-root.io.6"},{"fixed":"14.1.0-root.io.2"},{"fixed":"14.2.31-root.io.3"},{"fixed":"14.1.4-root.io.6"},{"fixed":"14.2.18-root.io.3"},{"fixed":"13.3.0-root.io.4"},{"fixed":"14.1.0-root.io.5"},{"fixed":"14.2.16-root.io.3"},{"fixed":"14.0.0-root.io.4"},{"fixed":"14.1.0-root.io.3"},{"fixed":"14.2.18-root.io.4"},{"fixed":"13.5.4-root.io.3"},{"fixed":"14.2.31-root.io.1"},{"fixed":"14.2.0-root.io.3"},{"fixed":"13.4.19-root.io.5"},{"fixed":"14.2.31-root.io.4"},{"fixed":"14.2.29-root.io.2"},{"fixed":"14.2.0-root.io.1"},{"fixed":"13.5.4-root.io.4"},{"fixed":"14.2.21-root.io.1"},{"fixed":"14.1.3-root.io.3"},{"fixed":"14.2.16-root.io.1"},{"fixed":"13.3.0-root.io.8"},{"fixed":"14.2.21-root.io.3"},{"fixed":"14.2.32-root.io.3"},{"fixed":"14.2.29-root.io.3"},{"fixed":"13.5.11-root.io.9"},{"fixed":"14.1.3-root.io.4"},{"fixed":"14.2.0-root.io.4"},{"fixed":"14.2.30-root.io.6"},{"fixed":"14.2.33-root.io.6"},{"fixed":"14.2.28-root.io.4"},{"fixed":"14.1.0-root.io.6"},{"fixed":"13.5.6-root.io.7"},{"fixed":"14.2.18-root.io.5"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v15.5.21","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/vercel/next.js/releases/tag/v16.2.11","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-68g3-v927-f742"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c","tags":["web"]},{"url":"https://nextjs.org/blog/security-update-2025-12-11","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55184","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mwv6-3258-q52c"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55183","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w37m-7fhw-fmv9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64648.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64648","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-64648","title":"Next.js: Response Body Cache Confusion for Requests Containing Bodies","description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a  server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.","status":"published","published":"2026-07-27T19:20:42.623Z","modified":"2026-07-28T14:14:16.051Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-49565","description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a  server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.","status":"published","published":"2026-07-27T19:20:42Z","modified":"2026-07-28T14:14:16Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:31.399718Z"}],"ghsa":[{"id":"GHSA-68g3-v927-f742","title":"Next.js: Cache confusion of response bodies for requests with bodies","description":"## Impact\n\nA server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.\n\nThis only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`.\nSafe: `fetch(new Request(init), init)`\nUnsafe: `fetch(new Request(init), aDifferentInit)`\n\n## Workarounds\n\nNo workaround exists besides upgrading. Applications using Pages Router are not vulnerable.","status":"published","published":"2026-07-22T23:08:17Z","modified":"2026-07-22T23:08:20Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:40:51.375752Z"},{"id":"GHSA-mwv6-3258-q52c","title":"Next Vulnerable to Denial of Service with Server Components","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.","status":"published","published":"2025-12-11T22:49:27Z","modified":"2025-12-11T22:49:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-502","CWE-1395"],"updated_at":"2026-11-02T14:39:13.204325Z"},{"id":"GHSA-w37m-7fhw-fmv9","title":"Next Server Actions Source Code Exposure ","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.","status":"published","published":"2025-12-11T22:49:56Z","modified":"2025-12-11T22:49:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-497","CWE-502","CWE-1395"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2026-64648","description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a  server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.","status":"published","published":"2026-07-27T20:16:40.563Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"CVE-2026-64648","title":"Next.js: Response Body Cache Confusion for Requests Containing Bodies","description":"Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a  server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.","status":"published","published":"2026-07-27T19:20:42.623Z","modified":"2026-10-28T02:30:56.171035124Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"GHSA-68g3-v927-f742","title":"Next.js: Cache confusion of response bodies for requests with bodies","description":"## Impact\n\nA server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.\n\nThis only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`.\nSafe: `fetch(new Request(init), init)`\nUnsafe: `fetch(new Request(init), aDifferentInit)`\n\n## Workarounds\n\nNo workaround exists besides upgrading. Applications using Pages Router are not vulnerable.","status":"published","published":"2026-07-22T23:08:17Z","modified":"2026-09-10T03:51:10.587986551Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"GHSA-mwv6-3258-q52c","title":"Next Vulnerable to Denial of Service with Server Components","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denial of service in unpatched environments.","status":"published","published":"2025-12-11T22:49:27Z","modified":"2026-09-10T03:50:31.942194779Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1395","CWE-400","CWE-502"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"GHSA-w37m-7fhw-fmv9","title":"Next Server Actions Source Code Exposure ","description":"A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.","status":"published","published":"2025-12-11T22:49:56Z","modified":"2026-09-10T03:50:32.139022825Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-1395","CWE-497","CWE-502"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"CLSA-2026-1786538556","title":"TuxCare security update for 13 packages (3 CVEs)","description":"TuxCare rebuilt 13 packages to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"withdrawn","published":"2026-08-12T12:42:36Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787663916","title":"TuxCare security update for 13 packages (2 CVEs)","description":"TuxCare rebuilt 13 packages to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"withdrawn","published":"2026-08-25T13:18:36Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1791901908","title":"TuxCare security update for 9 packages (10 CVEs)","description":"TuxCare rebuilt 9 packages to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.","status":"withdrawn","published":"2026-10-13T14:31:48Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792195748","title":"TuxCare security update for create-next-app (3 CVEs)","description":"TuxCare rebuilt create-next-app to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-17T00:09:05Z","modified":"2026-10-17T01:30:10.609588377Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792195753","title":"TuxCare security update for create-next-app (2 CVEs)","description":"TuxCare rebuilt create-next-app to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-17T00:09:09Z","modified":"2026-10-17T01:30:09.136815777Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196877","title":"TuxCare security update for @next/eslint-plugin-next (3 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-17T00:27:56Z","modified":"2026-10-17T01:30:13.007480268Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792196880","title":"TuxCare security update for @next/eslint-plugin-next (2 CVEs)","description":"TuxCare rebuilt @next/eslint-plugin-next to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-17T00:27:57Z","modified":"2026-10-17T01:30:13.018636331Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206303","title":"TuxCare security update for @next/bundle-analyzer (3 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-17T03:05:03Z","modified":"2026-10-17T07:00:40.485390998Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792206307","title":"TuxCare security update for @next/bundle-analyzer (2 CVEs)","description":"TuxCare rebuilt @next/bundle-analyzer to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-17T03:05:03Z","modified":"2026-10-17T07:00:40.487545518Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792272243","title":"TuxCare security update for @next/plugin-storybook (3 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-17T21:24:03Z","modified":"2026-10-18T01:30:33.784079989Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792272248","title":"TuxCare security update for @next/plugin-storybook (2 CVEs)","description":"TuxCare rebuilt @next/plugin-storybook to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-17T21:24:04Z","modified":"2026-10-18T01:30:41.062546019Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293003","title":"TuxCare security update for @next/polyfill-module (2 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-18T03:09:59Z","modified":"2026-10-18T07:15:10.798319982Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792293014","title":"TuxCare security update for @next/polyfill-module (3 CVEs)","description":"TuxCare rebuilt @next/polyfill-module to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-18T03:10:14Z","modified":"2026-10-18T07:15:11.900987165Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792304721","title":"TuxCare security update for @next/polyfill-nomodule (3 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-18T06:25:17Z","modified":"2026-10-18T07:15:16.007638916Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792304743","title":"TuxCare security update for @next/polyfill-nomodule (2 CVEs)","description":"TuxCare rebuilt @next/polyfill-nomodule to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-18T06:25:39Z","modified":"2026-10-18T07:15:08.894061943Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326296","title":"TuxCare security update for @next/react-refresh-utils (3 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-18T12:24:52Z","modified":"2026-10-18T13:15:57.152727069Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792326306","title":"TuxCare security update for @next/react-refresh-utils (2 CVEs)","description":"TuxCare rebuilt @next/react-refresh-utils to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-18T12:25:02Z","modified":"2026-10-18T13:16:00.060387682Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338236","title":"TuxCare security update for @next/third-parties (3 CVEs)","description":"TuxCare rebuilt @next/third-parties to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-18T15:43:53Z","modified":"2026-10-18T19:15:41.356774694Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792338239","title":"TuxCare security update for @next/third-parties (2 CVEs)","description":"TuxCare rebuilt @next/third-parties to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-18T15:43:57Z","modified":"2026-10-18T19:15:40.659340593Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792346492","title":"TuxCare security update for @next/swc-linux-x64-gnu (10 CVEs)","description":"TuxCare rebuilt @next/swc-linux-x64-gnu to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.","status":"published","published":"2026-10-18T18:01:28Z","modified":"2026-10-18T19:16:08.006507259Z","updated_at":"2026-11-02T15:43:52.782414Z"},{"id":"CLSA-2026-1792358597","title":"TuxCare security update for @next/codemod (3 CVEs)","description":"TuxCare rebuilt @next/codemod to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-18T21:23:16Z","modified":"2026-10-19T07:46:01.582175743Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792358600","title":"TuxCare security update for @next/codemod (2 CVEs)","description":"TuxCare rebuilt @next/codemod to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-18T21:23:16Z","modified":"2026-10-19T07:46:01.183291686Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364003","title":"TuxCare security update for @next/mdx (3 CVEs)","description":"TuxCare rebuilt @next/mdx to address 3 CVEs. Fixed in 14.2.35-tuxcare.6.","status":"published","published":"2026-10-18T22:53:22Z","modified":"2026-10-19T07:46:06.593773332Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792364007","title":"TuxCare security update for @next/mdx (2 CVEs)","description":"TuxCare rebuilt @next/mdx to address 2 CVEs. Fixed in 13.5.11-tuxcare.16.","status":"published","published":"2026-10-18T22:53:23Z","modified":"2026-10-19T07:46:07.296606888Z","updated_at":"2026-11-02T15:43:53.071325Z"},{"id":"CLSA-2026-1792367395","title":"TuxCare security update for @next/swc-linux-arm64-gnu (10 CVEs)","description":"TuxCare rebuilt @next/swc-linux-arm64-gnu to address 10 CVEs. Fixed in 15.1.2-tuxcare.3.","status":"published","published":"2026-10-18T23:49:51Z","modified":"2026-10-19T07:46:33.865706258Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"ROOT-APP-NPM-CVE-2026-64648","title":"CVE-2026-64648 in next - Patched by Root","description":"Root has patched CVE-2026-64648 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-27T08:33:06Z","modified":"2026-10-27T09:15:04.283721543Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-mwv6-3258-q52c","title":"GHSA-mwv6-3258-q52c in next - Patched by Root","description":"Root has patched GHSA-mwv6-3258-q52c in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-22T11:23:10Z","modified":"2026-09-22T12:15:06.827843703Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}