Junglewise Threat Intelligence

CVE-2026-64648: Vercel Next.js cache confusion in server-side fetch

CVE-2026-64648 · Severity: medium · CVSS 4 · Published 2026-07-27

Executive brief

Next.js is a popular framework used to build web applications. A security flaw in its server-side data fetching mechanism could cause the system to accidentally serve sensitive data from one user's request to a different, unauthorized user. This occurs because the framework may incorrectly reuse cached responses even when the underlying request data is different, potentially leading to the exposure of private information.

Technical details

A cache confusion vulnerability exists in Next.js App Router due to improper cache key generation for server-side fetch calls. When a fetch call is made using a Request object and a separate initialization object (init) that differs from the Request's own init, the framework may fail to distinguish between requests with different bodies. This results in the server returning a cached response body from a previous request to the same URL, even if the POST bodies were different. The vulnerability is classified as CWE-524 (Use of Cache Containing Sensitive Information) and has been patched in versions 15.5.21 and 16.2.11. Applications using the Pages Router are not affected.

Affected products

  • Vercel Next.js >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11

Timeline

  • 2026-07-21: advisory: GitHub Security Advisory published
  • 2026-07-21: patched: Fixed in versions 15.5.21 and 16.2.11
  • 2026-07-27: disclosed: CVE published to NVD

References

Related threats