Executive brief
Next.js is a popular framework used to build and serve web applications. A vulnerability in how it handles React Server Components allows attackers to trick web caches into storing the wrong type of data for a page. This results in legitimate visitors seeing raw technical data (component payloads) instead of the intended website interface, potentially disrupting site operations and user experience.
Technical details
A cache poisoning vulnerability exists in Next.js due to an interpretation conflict (CWE-436) in how React Server Component (RSC) request headers are handled. When shared caches or CDNs do not correctly partition response variants based on RSC headers, an attacker can craft requests that cause the cache to store an RSC payload under the URL normally reserved for HTML content. This results in subsequent users receiving the raw RSC payload instead of the rendered HTML. The fix involves consistent validation of RSC request headers and enforcement of cache-busting behavior. Patches are available in versions 15.5.16 and 16.2.5.
Affected products
- Vercel Next.js >= 14.2.0, < 15.5.16; >= 16.0.0, < 16.2.5
Timeline
- 2026-05-06: advisory: GitHub advisory published by Vercel
- 2026-05-13: disclosed: CVE published to NVD