CVE-2026-103004

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Oct 1, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A caching mistake in Next.js can cause content meant for one version of a page to be shown to visitors requesting a different version of that page.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Data Exposure
Component: Web Framework
Class: Information Disclosure
Remediation: Upgrade
Effort: Low
Patch risk: Low

What it actually does

Incorrect cache key computation for nested 'use cache' functions that read root params under cacheComponents: true causes an enclosing cache entry to omit the root param, allowing a single cached response to be served for any root param value.

Why it matters to the business

Cached page content intended for one set of root parameters may be returned to requests for different parameters, potentially exposing data that should have been isolated even though an attacker cannot choose which content is leaked.

How an attack unfolds

An attacker issues requests for pages using different root param values. Because the first writer of the cache entry determines the content served to all subsequent requests, a response generated for one root param value can be returned for another; downstream shared caches may further distribute the incorrectly keyed content.

How to fix it

Upgrade to Next.js 16.3.8 or later. Disable cacheComponents if immediate upgrade is not possible. Review any 'use cache' functions that read root params and ensure they are not nested inside other cached functions.

How to confirm the fix worked

Confirm the installed Next.js version is 16.3.8 or newer; test affected routes by requesting the same URL with varying root param values and verify that each returns only content matching its own params.

Typical attack path

Identify Next.js application running versions 16.3.0-16.3.7 with cacheComponents enabled
Locate routes using nested 'use cache' functions that read root params via next/root-params
Issue requests exercising different root param values in an order that populates the cache from the first invocation
Observe that subsequent requests receive content produced for a different root param value

How to detect it

Search application and CDN access logs for repeated requests to the same route pattern with varying root param values that result in identical response bodies or cache headers; inspect Next.js build output and runtime cache entries for missing root-param segments in keys.

What your security team should do

Prioritize upgrade to 16.3.8 across all environments within the next sprint
Audit codebases for cacheComponents: true combined with nested 'use cache' usage of root params
Add automated dependency scanning to block future vulnerable Next.js releases
Monitor cache hit rates and response content for unexpected cross-param leakage until patched

The record

Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first. This has been patched in 16.3.8.

Affected packages

Ecosystem	Package	Introduced	Fixed