Junglewise Threat Intelligence

CVE-2026-64647: Vercel Next.js cache confusion in server-side fetch requests

CVE-2026-64647 · Severity: medium · CVSS 4 · Published 2026-07-27

Executive brief

Next.js uses a caching mechanism for server-side fetch requests. When a request body contains non-UTF-8 character encodings (such as UTF-16), the cache key generation fails to account for byte-level differences, causing responses from different requests to be mixed up. An attacker can craft requests with non-UTF-8 bodies to obtain cached response data intended for other users, potentially exposing confidential information.

Technical details

The vulnerability is a cache key collision issue (CWE-116: Improper Encoding or Escaping of Output) in Next.js's incremental static regeneration (ISR) and fetch caching layer. When server-side fetch requests include a body with a non-UTF-8 character set (e.g., UTF-16), the cache key generation normalizes the body in a way that different byte sequences from different encodings can produce identical cache keys. For example, UTF-16 sequences for Korean characters 삃삃 and 섄섄 would collide despite being different requests. An unauthenticated network attacker can exploit this by sending a fetch request with a crafted non-UTF-8 body to retrieve a cached response from a different user's request. Pages Router applications are not affected. The issue was fixed by implementing byte-exact cache keys that preserve the exact binary representation of request bodies. Patches are available in Next.js versions 15.5.21 and 16.2.11.

Affected products

  • Vercel Next.js >=13.0.0 <15.5.21, >=16.0.0 <16.2.11

Timeline

  • 2026-07-22: disclosed: Advisory GHSA-4633-3j49-mh5q published
  • 2026-07-21: patched: Fix merged in PR #96008; patches released in v15.5.21 and v16.2.11

References

Related threats