Server-Side Fetch Vulnerability in Next.js Framework by Vercel
CVE-2026-64648
What is CVE-2026-64648?
In Next.js, a server-side fetch operation may inadvertently return a cached response body from an earlier request to the same URL with a different request body. This behavior occurs in versions ranging from 12.0.0 to 15.5.20 and from 16.0.0 to 16.2.10, exposing sensitive data through unintended response leakage. While the fetch request itself is not deduplicated, developers must be cautious when using variations in request initialization. The presence of this vulnerability underscores the importance of maintaining server integrity and ensuring secure response handling. Users are encouraged to update to versions 15.5.21 and 16.2.11 or later to mitigate this issue.
Affected Version(s)
next.js >= 13.0.0, < 15.5.21 < 13.0.0, 15.5.21
next.js >= 16.0.0, < 16.2.11 < 16.0.0, 16.2.11