SB2026110471 - Multiple vulnerabilities in Next.js

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110471

SB2026110471 - Multiple vulnerabilities in Next.js

Published: November 4, 2026

Security Bulletin ID SB2026110471
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 83% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-119348)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject responses delivered to other clients and disclose other clients' responses.

The vulnerability exists due to inconsistent HTTP response framing in self-hosted Next.js App Router route handlers and the fetch cache when forwarding fetched upstream responses unchanged. A remote attacker can supply a crafted upstream response whose declared framing does not match the transmitted body to desynchronize responses between clients, inject responses, and disclose other clients' responses.


2) Use of cache containing sensitive information (CVE-ID: CVE-2026-119349)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose cached data belonging to other users or poison cached results served to other users.

The vulnerability exists due to incorrect cache key generation in the Next.js App Router's use cache functionality when processing distinct binary arguments, such as Uint8Array or Blob values. A remote attacker can supply binary arguments that produce the same cache key as different arguments to retrieve another user's cached results or poison results shared across users.


3) Input validation error (CVE-ID: CVE-2026-119350)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to poison a shared fallback shell cache, causing persistent 404 responses or substituting a route parameter value in server-rendered pages for other visitors.

The vulnerability exists due to improper validation of request-supplied route parameters in the Next.js Cache Components fallback shell rendering when a path segment containing the percent-encoded, bracketed name of its own route parameter is interpreted as an unresolved prerender placeholder. A remote attacker can send a crafted GET request to cause a layout-rendered parameter value and its HTTP status to be cached under a key shared by a family of routes, resulting in persistent 404 responses or incorrect server-rendered content.

Affected deployments are self-hosted with next start and have cacheComponents enabled with Partial Prefetching disabled or unset.


4) Input validation error (CVE-ID: CVE-2026-119347)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass SVG processing restrictions and potentially cause a denial of service.

The vulnerability exists due to improper input validation in the Next.js image optimizer (/_next/image) when handling attacker-supplied images. A remote attacker can submit an SVG image that bypasses rejection even when dangerouslyAllowSVG is false, reaching the disabled SVG parser and potentially causing a denial of service.

The issue affects self-hosted deployments.


5) Race condition (CVE-ID: CVE-2026-119790)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose cached data associated with other root parameter values in Next.js applications.

The vulnerability exists due to a cross-request deduplication race condition in Next.js caching when a root-parameter-reading 'use cache' function is called both directly during rendering and through unstable_cache(). A remote attacker can send a request through the unstable_cache() path during a concurrent direct cache fill to bypass the root parameter check and cause data for one root parameter value to be cached and returned to requests for other values.

Exploitation requires the unstable_cache() request to arrive while the function's first cache fill after a process start is still in flight.


6) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-119346)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive HttpOnly cookie values, including session tokens, through JavaScript running on the application's origin.

The vulnerability exists due to exposure of sensitive cookie data in a public response header in Next.js Edge runtime routes when setting cookies through NextResponse. A remote attacker can use JavaScript running on the same origin to read the internal x-middleware-set-cookie response header and obtain sensitive cookie values that would otherwise be inaccessible to JavaScript through the HttpOnly protection.


Remediation

Install update from vendor's website.

References