Summary
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Advisory details
Impact
A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.
This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache.
Workarounds
If you cannot upgrade, consider only making fetch requests with UTF-8 bodies (default in Next.js). Applications using Pages Router are not vulnerable.
References
- https://github.com/advisories/GHSA-4633-3j49-mh5q
- https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q
- https://github.com/vercel/next.js/pull/96008
- https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
Related vulnerabilities
All Supply chain →- CRITICALCVE-2026-62681
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
- CRITICALCVE-2026-62682
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
- CRITICALCVE-2026-72717
Orval: Import-time RCE via schema default -> zod module-level template literal
- CRITICALCVE-2026-71869
Orval: Import-time RCE via array-items default -> zod module-level template literal
- CRITICALCVE-2026-71871
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
- CRITICALCVE-2026-71865
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli