Use of cache containing sensitive information in Next.js - CVE-2026-119349
Published: November 4, 2026
Vulnerability identifier: #VU159253
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119349
CWE-ID: CWE-524
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose cached data belonging to other users or poison cached results served to other users.
The vulnerability exists due to incorrect cache key generation in the Next.js App Router's use cache functionality when processing distinct binary arguments, such as Uint8Array or Blob values. A remote attacker can supply binary arguments that produce the same cache key as different arguments to retrieve another user's cached results or poison results shared across users.
Affected software
Next.js
How to mitigate CVE-2026-119349
Install security update from vendor's website.
Next.js - addressed in versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5