next.js cache leak on warm `use cache` handlers accessing root param
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first. This has been patched in 16.3.8.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vercel | next.js | before 16.3.8 | 16.3.8 | Patch available | CNA |
| — | next (npm) | 16.3.0 to before 16.3.8 | 16.3.8 | Patch available | GHSA-h694-7cp9-m8p3 |
- next.js Vendorvercel Affected before 16.3.8 Fixed in 16.3.8 Patch available CNA
- next (npm) Vendor— Affected 16.3.0 to before 16.3.8 Fixed in 16.3.8 Patch available GHSA-h694-7cp9-m8p3
Remediation
- Fix · CNA next.js (vercel) Fixed in 16.3.8
- Fix · GHSA-h694-7cp9-m8p3 next (npm) Fixed in 16.3.8 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-103004
- 2026-10-05 CVSS score added · NVD
- 2026-10-22 Alias added: GHSA-h694-7cp9-m8p3
- 2026-10-22 Fix available: npm/[email protected] · GHSA-h694-7cp9-m8p3
- 2026-10-22 CVSS score added · GHSA-h694-7cp9-m8p3
- 2026-10-22 Weakness changed · GHSA-h694-7cp9-m8p3
- 2026-10-22 5 new references · GHSA-h694-7cp9-m8p3
References
Advisory 2
More vercel Next.js vulnerabilities
- TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
- TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
- TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
- TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
- TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
- TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
Sources
- CVE-2026-103004 · CVE Program
- CVE-2026-103004 · NVD
- FIRST EPSS
- GHSA-h694-7cp9-m8p3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-103004 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences