SB2026110474 - Use of cache containing sensitive information in Next.js

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110474

SB2026110474 - Use of cache containing sensitive information in Next.js

Published: November 4, 2026

Security Bulletin ID SB2026110474
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of cache containing sensitive information (CVE-ID: CVE-2026-119351)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain cached content produced for a different root parameter value, potentially disclosing sensitive information.

The vulnerability exists due to incomplete cache key construction in nested 'use cache' functions in Next.js when Cache Components is enabled and an inner function reads a root parameter and returns a value containing pending promises. A remote attacker can request content that uses these functions to receive another root parameter value's cached content because the outer cache entry can be persisted before the inner function publishes its root parameter dependencies.

The leaked value cannot be chosen by the requester; the content served depends on which invocation first wrote the cache entry.


Remediation

Install update from vendor's website.

References