Use of cache containing sensitive information in Next.js - CVE-2026-119351
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to obtain cached content produced for a different root parameter value, potentially disclosing sensitive information.
The vulnerability exists due to incomplete cache key construction in nested 'use cache' functions in Next.js when Cache Components is enabled and an inner function reads a root parameter and returns a value containing pending promises. A remote attacker can request content that uses these functions to receive another root parameter value's cached content because the outer cache entry can be persisted before the inner function publishes its root parameter dependencies.
The leaked value cannot be chosen by the requester; the content served depends on which invocation first wrote the cache entry.