CVE-2026-64647: Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
Impact
A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.
This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache.
Workarounds
If you cannot upgrade, consider only making fetch requests with UTF-8 bodies (default in Next.js). Applications using Pages Router are not vulnerable.
Other sources
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.2.11 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.21 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 15.5.21 - Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 16.2.11 - Configuration
If you cannot upgrade, make server-side fetch requests with UTF-8 request bodies (since the issue only occurs when receiving request bodies with a content type charset other than UTF-8).
Next.js server-side fetch fetch request body charset = UTF-8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64647?
CVE-2026-64647 has a risk score of 37, indicating a significant potential impact.
What type of vulnerability is CVE-2026-64647?
CVE-2026-64647 is a server-side caching issue that can cause data leakage from unauthorized requests.
How do I fix CVE-2026-64647?
To fix CVE-2026-64647, ensure that server-side fetch mechanisms properly handle request bodies and implement deduplication for responses.
What software is affected by CVE-2026-64647?
CVE-2026-64647 affects the npm package 'next', which is commonly used in web applications.
What are the potential consequences of CVE-2026-64647?
The potential consequences of CVE-2026-64647 include exposure of confidential data to unauthorized users through cached responses.