Executive brief
Next.js is a popular framework used to build and deploy web applications. A vulnerability in how it handles data updates (React Server Components) could allow an attacker to trick shared web caches into storing the wrong version of a page. This could result in users seeing incorrect or outdated information instead of the intended content.
Technical details
A cache poisoning vulnerability exists in Next.js due to the use of a weak hash (CWE-328) in the '_rsc' cache-busting mechanism. In deployments utilizing shared caches with insufficient response partitioning, an attacker can trigger collisions in the cache-busting value. This allows the attacker to poison cache entries, causing the server to return the wrong response variant for a specific URL. The attack requires high complexity to achieve a practical collision but can be executed over the network without authentication. The issue is resolved in versions 15.5.16 and 16.2.5 by strengthening the cache-busting mechanism.
Affected products
- Vercel Next.js >= 13.4.6, < 15.5.16; >= 16.0.0, < 16.2.5
Timeline
- 2026-05-06: advisory: GitHub advisory published by Vercel
- 2026-05-13: disclosed: NVD publication date