next@16.3.6

next is a react framework.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) in applications using App router with Cache Component.

Upgrade next to version 16.4.1 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Origin Validation Error via the MCP middleware (get-mcp-middleware.ts) and the cross-site dev request blocker (block-cross-site-dev.ts), which fail to adequately validate the request origin against the host. An attacker who controls a DNS record can rebind a malicious domain to the victim's localhost address, causing the victim's browser to issue cross-origin requests to the local Next.js development server that bypass the intended origin checks, resulting in limited confidentiality and integrity impact.

Upgrade next to version 16.3.8 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the 'use cache' mechanism, where draft mode state is not accounted for when sharing cached fills between concurrent requests. A cache fill executed under draft mode - which may contain unpublished content - can be registered and served to other non-draft requests, and conversely a draft mode request can join a pending public fill and receive published content instead of draft content, leaking unpublished data across request boundaries.

Upgrade next to version 16.3.8 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys in the server's route caching logic in base-server.ts. Because cache keys are not bound to their source route, a response cached for one route can be served for a different route that shares the same key, allowing an attacker to poison the cache and cause other users to receive incorrect or attacker-influenced responses, or to trigger a denial of service through cache corruption.

Upgrade next to version 15.5.27, 16.3.8 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Origin Validation Error via the MCP middleware endpoint /_next/mcp, where insufficient host validation allows a DNS rebinding attack. An attacker who controls a malicious DNS server can cause a victim's browser to treat the attacker's domain as a same-origin resource, bypassing the cross-site request protections applied in development mode and gaining read access to confidential data exposed by the MCP server.

Upgrade next to version 16.3.8 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys in the server's cache key generation logic, where cache keys are not bound to their source route. An attacker can trigger a cache key collision between distinct routes, causing one route's cached response to be served for a different route and resulting in partial availability loss for affected endpoints.

Upgrade next to version 15.5.27, 16.3.8, 16.3.8 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the use-cache-wrapper.ts cache function, where draft mode state is not accounted for when sharing cached fills across concurrent requests. A draft mode request can join a pending public cache fill and receive published content instead of draft content, or conversely, a fill executed under draft mode containing unpublished content can be registered and served to non-draft requests.

Note: This is only exploitable when the 'use cache' directive is in use and concurrent requests occur, one of which has draft mode enabled.

Upgrade next to version 16.3.8 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys to their source route in base-server.ts and related export/build pipeline files. When multiple routes share a cache key, a response generated for one route can be served to requests for a different route, allowing an attacker to cause incorrect cached content to be returned to users, resulting in limited availability impact through cache poisoning or stale-data delivery.

Upgrade next to version 16.3.8, 15.5.27 or higher.

next is a react framework.

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via incorrect cache keying in nested 'use cache' function handlers that access root params. When Cache Components is enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function which reads a root param can be keyed incorrectly when the inner call is served from an existing cache entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value, whether the page is prerendered at build time, at runtime, or rendered dynamically, and shared cache headers allow downstream caches to redistribute the mismatched content further.

Note: This is only exploitable when the cacheComponents: true option is enabled and the application uses nested 'use cache' functions where the inner function reads a root param.

Upgrade next to version 16.3.8 or higher.