Server-Side Fetch Vulnerability in Next.js Framework by Vercel
CVE-2026-64648

6MEDIUM

Key Information:

Vendor

Vercel

Status
Vendor
CVE Published:
27 July 2026

What is CVE-2026-64648?

In Next.js, a server-side fetch operation may inadvertently return a cached response body from an earlier request to the same URL with a different request body. This behavior occurs in versions ranging from 12.0.0 to 15.5.20 and from 16.0.0 to 16.2.10, exposing sensitive data through unintended response leakage. While the fetch request itself is not deduplicated, developers must be cautious when using variations in request initialization. The presence of this vulnerability underscores the importance of maintaining server integrity and ensuring secure response handling. Users are encouraged to update to versions 15.5.21 and 16.2.11 or later to mitigate this issue.

Affected Version(s)

next.js >= 13.0.0, < 15.5.21 < 13.0.0, 15.5.21

next.js >= 16.0.0, < 16.2.11 < 16.0.0, 16.2.11

References

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.