CVE-2026-64648: Vercel Next.js cache confusion in server-side fetch

CVE-2026-64648 · Severity: medium · CVSS 4 · Published 2026-07-27

Next.js is a popular framework used to build web applications. A security flaw in its server-side data fetching mechanism could cause the system to accidentally serve sensitive data from one user's request to a different, unauthorized user. This occurs because the framework may incorrectly reuse cached responses even when the underlying request data is different, potentially leading to the exposure of private information.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is CVE-2026-64648 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-64648 being exploited in the wild.
How severe is CVE-2026-64648?
Medium severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?
next (npm) SEMVER:introduced=13.0.0,fixed=15.5.21; Vercel Next.js >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11.
Is there a fix for CVE-2026-64648?
Yes. next (npm): upgrade to 15.5.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64648 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-64648?
Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next (npm): upgrade to 15.5.21 or later
    npm install next@15.5.21

Technical details

A cache confusion vulnerability exists in Next.js App Router due to improper cache key generation for server-side fetch calls. When a fetch call is made using a Request object and a separate initialization object (init) that differs from the Request's own init, the framework may fail to distinguish between requests with different bodies. This results in the server returning a cached response body from a previous request to the same URL, even if the POST bodies were different. The vulnerability is classified as CWE-524 (Use of Cache Containing Sensitive Information) and has been patched in versions 15.5.21 and 16.2.11. Applications using the Pages Router are not affected.

Affected products

  • Vercel Next.js >= 13.0.0, < 15.5.21; >= 16.0.0, < 16.2.11

Identifiers

  • CVE-2026-64648
  • GHSA-68g3-v927-f742

Timeline

  • 2026-07-21: advisory: GitHub Security Advisory published
  • 2026-07-21: patched: Fixed in versions 15.5.21 and 16.2.11
  • 2026-07-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.