{"id":"CVE-2026-119346","kind":"vulnerability","aliases":["CVE-2026-119346","GHSA-f3mh-rxg3-f5g2"],"related":[],"title":"HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes","description":"<!-- https://linear.app/vercel/issue/NSEC-717 -->\r\n\r\nNext.js applications that set cookies through `NextResponse` on Edge runtime routes — App Router route handlers and Pages Router Edge API routes — send an internal `x-middleware-set-cookie` header in the public response, duplicating the cookie value and its attributes. This makes HttpOnly cookies, such as session tokens, readable by JavaScript running on the same origin when an application sets a sensitive cookie on an affected response.","summary":"Next.js applications that set cookies with NextResponse on Edge runtime routes expose an internal x-middleware-set-cookie header in public responses. That header repeats cookie values, so an attacker running JavaScript on the same origin can read HttpOnly session cookies.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.4.5"],"affected":">= 16.0.0, <= 16.4.4","ecosystem":"npm"},{"name":"next","fixed":["15.5.29"],"affected":">= 15.0.0, <= 15.5.28","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["edge-runtime","next.js","package","self-hosted","vercel"],"not_affected_if":["next-below-affected-range","no-cookies-set-in-edge","no-edge-runtime-routes"],"how_to_check":"- Check the installed version with `npm ls next`\n- Look for Edge runtime routes that call NextResponse with cookies set (`export const runtime = 'edge'` in App Router route handlers, or Pages Router Edge API routes)\n- Inspect a response from such a route for an `x-middleware-set-cookie` header","fix":"- next `16.4.5` for the 16.x line\n- next `15.5.29` for the 15.x line","status":"open","published_at":"2026-11-03T18:39:54+00:00","first_seen_at":"2026-11-09T22:53:13+00:00","triaged_at":"2026-11-09T22:55:09+00:00","updated_at":"2026-11-09T22:55:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:55:09Z","model":"claude-haiku-5-5","output":{"fix":"- next `16.4.5` for the 16.x line\n- next `15.5.29` for the 15.x line","reach":"internet","title":"Next.js: Edge routes leak HttpOnly cookies through an internal response header","impact":"medium","summary":"Next.js applications that set cookies with NextResponse on Edge runtime routes expose an internal x-middleware-set-cookie header in public responses. That header repeats cookie values, so an attacker running JavaScript on the same origin can read HttpOnly session cookies.","audience":"developers","category":"package","nicknames":[],"who_cares":["next.js","edge-runtime","self-hosted","vercel"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"same-origin scripts read HttpOnly session cookies","analyst_note":"","how_to_check":"- Check the installed version with `npm ls next`\n- Look for Edge runtime routes that call NextResponse with cookies set (`export const runtime = 'edge'` in App Router route handlers, or Pages Router Edge API routes)\n- Inspect a response from such a route for an `x-middleware-set-cookie` header","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-edge-runtime-routes","no-cookies-set-in-edge","next-below-affected-range"],"who_is_affected":"Applications built on Next.js 15 or 16 that set cookies through NextResponse in Edge runtime route handlers or Edge API routes. Applications that do not use the Edge runtime for those routes, or that never set cookies there, are not exposed. The exposure is same-origin JavaScript reading HttpOnly cookies, so an XSS flaw on the site raises the risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000788,"input_tokens":4732,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119346':15A,23A '-2026':14A,22A 'affect':143C 'api':96C 'app':88C 'applic':36B,78C,136C 'attack':65B 'attribut':117C 'cooki':2A,39B,53B,61B,76B,81C,105C,113C,121C,140C 'cve':13A,21A 'duplic':111C 'edg':10A,27B,43B,85C,95C 'edge-runtim':26B 'expos':46B 'exposur':3A 'f3mh':18A 'f5g2':20A 'ghsa':17A 'ghsa-f3mh-rxg3-f5g2':16A 'handler':91C 'header':7A,54B,59B,106C 'host':33B 'httpon':1A,74B,120C 'intern':5A,48B,100C 'javascript':67B,128C 'make':119C 'middlewar':51B,103C 'next':24A,25A 'next.js':9A,29B,35B,77C 'nextrespons':41B,83C 'origin':71B,133C 'packag':30B 'page':93C 'public':56B,109C 'read':73B 'readabl':126C 'repeat':60B 'respons':6A,57B,110C,144C 'rout':12A,45B,87C,90C,97C 'router':89C,94C 'run':66B,129C 'runtim':11A,28B,44B,86C 'rxg3':19A 'self':32B 'self-host':31B 'send':98C 'sensit':139C 'session':75B,124C 'set':38B,52B,80C,104C,137C 'token':125C 'valu':62B,114C 'vercel':34B 'x':50B,102C 'x-middleware-set-cooki':49B,101C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Next.js 15 or 16 that set cookies through NextResponse in Edge runtime route handlers or Edge API routes. Applications that do not use the Edge runtime for those routes, or that never set cookies there, are not exposed. The exposure is same-origin JavaScript reading HttpOnly cookies, so an XSS flaw on the site raises the risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["next"],"ptokens":["next"],"labels":["edgeruntime","medium","nextjs","npm","package","selfhosted","vercel"],"campaign_type":null,"search_a":"'-119346':15A,23A '-2026':14A,22A 'cooki':2A 'cve':13A,21A 'edg':10A 'exposur':3A 'f3mh':18A 'f5g2':20A 'ghsa':17A 'ghsa-f3mh-rxg3-f5g2':16A 'header':7A 'httpon':1A 'intern':5A 'next':24A,25A 'next.js':9A 'respons':6A 'rout':12A 'runtim':11A 'rxg3':19A","search_b":"'applic':36B 'attack':65B 'cooki':39B,53B,61B,76B 'edg':27B,43B 'edge-runtim':26B 'expos':46B 'header':54B,59B 'host':33B 'httpon':74B 'intern':48B 'javascript':67B 'middlewar':51B 'next.js':29B,35B 'nextrespons':41B 'origin':71B 'packag':30B 'public':56B 'read':73B 'repeat':60B 'respons':57B 'rout':45B 'run':66B 'runtim':28B,44B 'self':32B 'self-host':31B 'session':75B 'set':38B,52B 'valu':62B 'vercel':34B 'x':50B 'x-middleware-set-cooki':49B","search_c":"'affect':143C 'api':96C 'app':88C 'applic':78C,136C 'attribut':117C 'cooki':81C,105C,113C,121C,140C 'duplic':111C 'edg':85C,95C 'handler':91C 'header':106C 'httpon':120C 'intern':100C 'javascript':128C 'make':119C 'middlewar':103C 'next.js':77C 'nextrespons':83C 'origin':133C 'page':93C 'public':109C 'readabl':126C 'respons':110C,144C 'rout':87C,90C,97C 'router':89C,94C 'run':129C 'runtim':86C 'send':98C 'sensit':139C 'session':124C 'set':80C,104C,137C 'token':125C 'valu':114C 'x':102C 'x-middleware-set-cooki':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T18:39:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-f3mh-rxg3-f5g2","url":"https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2","severity":"medium","published_at":"2026-11-03T18:39:54+00:00","modified_at":"2026-11-06T10:20:20+00:00","first_seen_at":"2026-11-09T22:53:13+00:00","fetched_at":"2026-11-09T22:53:13+00:00","note":null}],"documents":[{"id":110390,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}