# CVE-2026-64647: Vercel Next.js cache confusion in server-side fetch requests

Source: https://junglewise.ai/threats/cve-2026-64647-vercel-next-js-cache-confusion-in-server-side-fetch-requests  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64647 · Severity: medium · CVSS 4 · Published 2026-07-27

Next.js uses a caching mechanism for server-side fetch requests. When a request body contains non-UTF-8 character encodings (such as UTF-16), the cache key generation fails to account for byte-level differences, causing responses from different requests to be mixed up. An attacker can craft requests with non-UTF-8 bodies to obtain cached response data intended for other users, potentially exposing confidential information.

Technologies: [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-64647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64647 being exploited in the wild.

**How severe is CVE-2026-64647?** Medium severity, with a CVSS score of 4, published 27 July 2026.

**Which products and versions are affected?** Vercel Next.js >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11, >=13.0.0 <15.5.21, >=16.0.0 <16.2.11, 12.0.0 - 15.5.20, 16.0.0 - 16.2.10.

**Is there a fix for CVE-2026-64647?** A patch was published on 2026-07-21: Fix merged in PR #96008; patches released in v15.5.21 and v16.2.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64647 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-64647?** Check whether you run Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cache key collision issue (CWE-116: Improper Encoding or Escaping of Output) in Next.js's incremental static regeneration (ISR) and fetch caching layer. When server-side fetch requests include a body with a non-UTF-8 character set (e.g., UTF-16), the cache key generation normalizes the body in a way that different byte sequences from different encodings can produce identical cache keys. For example, UTF-16 sequences for Korean characters 삃삃 and 섄섄 would collide despite being different requests. An unauthenticated network attacker can exploit this by sending a fetch request with a crafted non-UTF-8 body to retrieve a cached response from a different user's request. Pages Router applications are not affected. The issue was fixed by implementing byte-exact cache keys that preserve the exact binary representation of request bodies. Patches are available in Next.js versions 15.5.21 and 16.2.11.

## Affected products

- Vercel Next.js >=13.0.0 <15.5.21, >=16.0.0 <16.2.11

## Identifiers

- CVE-2026-64647
- GHSA-4633-3j49-mh5q

## Timeline

- 2026-07-22: disclosed: Advisory GHSA-4633-3j49-mh5q published
- 2026-07-21: patched: Fix merged in PR #96008; patches released in v15.5.21 and v16.2.11

## References

- [https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q](https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q)
- [https://github.com/vercel/next.js/pull/96008](https://github.com/vercel/next.js/pull/96008)
- [https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082](https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082)
- [https://github.com/vercel/next.js](https://github.com/vercel/next.js)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://github.com/vercel/next.js/releases/tag/v16.2.11)

## Related threats

- [Vercel Next.js remote code execution in use cache functions](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3)
- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)