NEXT · CVE-2026-119346 · Package
FIX → 16.4.5 · 15.5.29
Next.js applications that set cookies with NextResponse on Edge runtime routes expose an internal x-middleware-set-cookie header in public responses. That header repeats cookie values, so an attacker running JavaScript on the same origin can read HttpOnly session cookies.
first public Nov 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on Next.js 15 or 16 that set cookies through NextResponse in Edge runtime route handlers or Edge API routes. Applications that do not use the Edge runtime for those routes, or that never set cookies there, are not exposed. The exposure is same-origin JavaScript reading HttpOnly cookies, so an XSS flaw on the site raises the risk.
Not affected if next-below-affected-range, no-cookies-set-in-edge, no-edge-runtime-routes
Who cares edge-runtime, next.js, self-hosted, vercel
npm ls nextexport const runtime = 'edge' in App Router route handlers, or Pages Router Edge API routes)x-middleware-set-cookie headerNext.js applications that set cookies through NextResponse on Edge runtime routes — App Router route handlers and Pages Router Edge API routes — send an internal x-middleware-set-cookie header in the public response, duplicating the cookie value and its attributes. This makes HttpOnly cookies, such as session tokens, readable by JavaScript running on the same origin when an application sets a sensitive cookie on an affected response.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 16.4.5 · 15.5.29
16.4.5 for the 16.x line15.5.29 for the 15.x line