CVE-2026-64648
mediumpriority · track · 22EPSS 0.003 · 27 %ileDEEUUSEPSS · scored 2026-10-27
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.3–6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2468Vercel Next.js: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
- GHSA-68g3-v927-f742Next.js: Cache confusion of response bodies for requests with bodies2026-07-22ghsa · osvUS
## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`. Safe: `fetch(new Request(init), init)` Unsafe: `fetch(new Request(init), aDifferentInit)` ## Workarounds No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262ccnnvd
- https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56acnnvd
- https://github.com/vercel/next.js/releases/tag/v15.5.21cnnvd
- https://github.com/vercel/next.js/releases/tag/v16.2.11cnnvd
- https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742cnnvd
- https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262cenisa_euvd
- https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56aenisa_euvd
- https://github.com/vercel/next.js/releases/tag/v15.5.21enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan