CVE-2026-64647: Vercel Next.js cache confusion in server-side fetch requests

CVE-2026-64647 · Severity: medium · CVSS 4 · Published 2026-07-27

Next.js uses a caching mechanism for server-side fetch requests. When a request body contains non-UTF-8 character encodings (such as UTF-16), the cache key generation fails to account for byte-level differences, causing responses from different requests to be mixed up. An attacker can craft requests with non-UTF-8 bodies to obtain cached response data intended for other users, potentially exposing confidential information.

Technologies: Vercel Next.js. Vendors: Vercel.

Quick answers

Is CVE-2026-64647 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-64647 being exploited in the wild.
How severe is CVE-2026-64647?
Medium severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?
Vercel Next.js >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11, >=13.0.0 <15.5.21, >=16.0.0 <16.2.11, 12.0.0 - 15.5.20, 16.0.0 - 16.2.10.
Is there a fix for CVE-2026-64647?
A patch was published on 2026-07-21: Fix merged in PR #96008; patches released in v15.5.21 and v16.2.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64647 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-64647?
Check whether you run Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cache key collision issue (CWE-116: Improper Encoding or Escaping of Output) in Next.js's incremental static regeneration (ISR) and fetch caching layer. When server-side fetch requests include a body with a non-UTF-8 character set (e.g., UTF-16), the cache key generation normalizes the body in a way that different byte sequences from different encodings can produce identical cache keys. For example, UTF-16 sequences for Korean characters 삃삃 and 섄섄 would collide despite being different requests. An unauthenticated network attacker can exploit this by sending a fetch request with a crafted non-UTF-8 body to retrieve a cached response from a different user's request. Pages Router applications are not affected. The issue was fixed by implementing byte-exact cache keys that preserve the exact binary representation of request bodies. Patches are available in Next.js versions 15.5.21 and 16.2.11.

Affected products

  • Vercel Next.js >=13.0.0 <15.5.21, >=16.0.0 <16.2.11

Identifiers

  • CVE-2026-64647
  • GHSA-4633-3j49-mh5q

Timeline

  • 2026-07-22: disclosed: Advisory GHSA-4633-3j49-mh5q published
  • 2026-07-21: patched: Fix merged in PR #96008; patches released in v15.5.21 and v16.2.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.