Race condition in Next.js - CVE-2026-119790
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose cached data associated with other root parameter values in Next.js applications.
The vulnerability exists due to a cross-request deduplication race condition in Next.js caching when a root-parameter-reading 'use cache' function is called both directly during rendering and through unstable_cache(). A remote attacker can send a request through the unstable_cache() path during a concurrent direct cache fill to bypass the root parameter check and cause data for one root parameter value to be cached and returned to requests for other values.
Exploitation requires the unstable_cache() request to arrive while the function's first cache fill after a process start is still in flight.