---
id: "CVE-2026-119346"
page: "https://infrastack.ai/live/CVE-2026-119346"
kind: "vulnerability"
aliases: ["CVE-2026-119346", "GHSA-f3mh-rxg3-f5g2"]
title: "HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "next", "fixed": ["16.4.5"], "affected": ">= 16.0.0, <= 16.4.4", "ecosystem": "npm"}, {"name": "next", "fixed": ["15.5.29"], "affected": ">= 15.0.0, <= 15.5.28", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["edge-runtime", "next.js", "package", "self-hosted", "vercel"]
not_affected_if: ["next-below-affected-range", "no-cookies-set-in-edge", "no-edge-runtime-routes"]
published_at: "2026-11-03T18:39:54+00:00"
first_seen_at: "2026-11-09T22:53:13+00:00"
updated_at: "2026-11-09T22:55:09+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2", "first_seen_at": "2026-11-09T22:53:13+00:00"}]
exploit_sources: []
---

# HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

Link for people: https://infrastack.ai/live/CVE-2026-119346 (this .md is for agents)

Next.js applications that set cookies with NextResponse on Edge runtime routes expose an internal x-middleware-set-cookie header in public responses. That header repeats cookie values, so an attacker running JavaScript on the same origin can read HttpOnly session cookies.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 16.0.0, <= 16.4.4 fixed 16.4.5
- npm:next affected >= 15.0.0, <= 15.5.28 fixed 15.5.29

## How to check

- Check the installed version with `npm ls next`
- Look for Edge runtime routes that call NextResponse with cookies set (`export const runtime = 'edge'` in App Router route handlers, or Pages Router Edge API routes)
- Inspect a response from such a route for an `x-middleware-set-cookie` header

## Fix

- next `16.4.5` for the 16.x line
- next `15.5.29` for the 15.x line

## Timeline

- 2026-11-09T22:53:13+00:00 ghsa-repo https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-f3mh-rxg3-f5g2

## From the sources

<!-- https://linear.app/vercel/issue/NSEC-717 -->

Next.js applications that set cookies through `NextResponse` on Edge runtime routes — App Router route handlers and Pages Router Edge API routes — send an internal `x-middleware-set-cookie` header in the public response, duplicating the cookie value and its attributes. This makes HttpOnly cookies, such as session tokens, readable by JavaScript running on the same origin when an application sets a sensitive cookie on an affected response.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_