CVE-2026-103004: next.js cache leak on warm `use cache` handlers accessing root param
Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further.
What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.
This has been patched in 16.3.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
next.jsto a version that resolves this vulnerability.Fixed in 16.3.8
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Next.js 16.3.0 through 16.3.7 with Cache Components enabled (cacheComponents: true) are affected when a warm 'use cache' handler calls another 'use cache' function that reads a root parameter through next/root-params.
What must occur for content to be served across root parameter values?
The inner cached call must be served from an existing cache entry, causing the enclosing function's cache key to omit the root parameter. The first invocation that writes the enclosing cache entry determines which root parameter's content can later be reused.
Can an attacker choose the content that is leaked?
No. The leaked values cannot be attacker controlled; the content served depends only on which invocation populated the affected cache entry first.
Does rendering mode prevent the issue?
No. The issue can occur for pages prerendered at build time, prerendered at runtime, or rendered dynamically. Shared cache headers can also allow downstream caches to redistribute the mismatched content.
What version fixes the issue?
The issue is patched in Next.js 16.3.8.