---
id: "CVE-2026-103004"
kind: "vulnerability"
aliases: ["CVE-2026-103004", "GHSA-h694-7cp9-m8p3"]
title: "next.js cache leak across root param values in nested 'use cache' functions"
severity: "medium"
cvss: 6.3
epss: 0.0024999999441206455
exploited: false
status: "open"
category: "package"
products: [{"name": "next", "fixed": ["16.3.8"], "affected": ">= 16.3.0, < 16.3.8", "ecosystem": "npm"}, {"name": "vercel next.js", "fixed": ["16.3.8"], "affected": ">= 16.3.0, < 16.3.8", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cache-components", "cwe-524", "multi-tenant", "next.js", "package", "self-hosted", "vercel"]
not_affected_if: ["cachecomponents-disabled", "no-nested-use-cache", "no-root-params", "version-outside-range"]
published_at: "2026-10-01T15:17:25+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h694-7cp9-m8p3", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103004", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# next.js cache leak across root param values in nested 'use cache' functions

Next.js with Cache Components enabled can cache one root param value's output under a key that ignores that param, so when a nested 'use cache' function is served from an existing entry, the outer entry is reused across root param values. An attacker cannot choose the leaked values, but one tenant's or locale's content can be served to requests meant for another, and shared caches can spread it further.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 16.3.0, < 16.3.8 fixed 16.3.8
- vendor:vercel next.js affected >= 16.3.0, < 16.3.8 fixed 16.3.8

## How to check

Check that node_modules/next/package.json reports a version >= 16.3.0 and < 16.3.8.
Search the app for 'cacheComponents: true' in next.config and for nested 'use cache' functions that read root params.

## Fix

Upgrade next to 16.3.8 or later.
No workarounds are known per the advisory; upgrade as soon as possible.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-h694-7cp9-m8p3
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103004

## From the sources

Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further.

What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.

This has been patched in 16.3.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_