Inconsistent interpretation of HTTP requests in Next.js - CVE-2026-119348
Published: November 4, 2026
Vulnerability identifier: #VU159251
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119348
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject responses delivered to other clients and disclose other clients' responses.
The vulnerability exists due to inconsistent HTTP response framing in self-hosted Next.js App Router route handlers and the fetch cache when forwarding fetched upstream responses unchanged. A remote attacker can supply a crafted upstream response whose declared framing does not match the transmitted body to desynchronize responses between clients, inject responses, and disclose other clients' responses.
Affected software
Next.js
How to mitigate CVE-2026-119348
Install security update from vendor's website.
Next.js - addressed in versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5