Input validation error in Next.js - CVE-2026-119350
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to poison a shared fallback shell cache, causing persistent 404 responses or substituting a route parameter value in server-rendered pages for other visitors.
The vulnerability exists due to improper validation of request-supplied route parameters in the Next.js Cache Components fallback shell rendering when a path segment containing the percent-encoded, bracketed name of its own route parameter is interpreted as an unresolved prerender placeholder. A remote attacker can send a crafted GET request to cause a layout-rendered parameter value and its HTTP status to be cached under a key shared by a family of routes, resulting in persistent 404 responses or incorrect server-rendered content.
Affected deployments are self-hosted with next start and have cacheComponents enabled with Partial Prefetching disabled or unset.