NEXT · CVE-2026-119348 · Runtime
FIX → 16.4.5 · 15.5.29
Self-hosted Next.js apps that pass a fetched upstream response through unchanged can send a response whose framing does not match its body. Behind an HTTP/1.1 reverse proxy that allows pipelined responses, an attacker can desynchronize responses and read or inject another client's responses.
first public Nov 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Next.js applications that use App Router route handlers or the fetch cache and return a fetched upstream response unchanged. Exposure also depends on an HTTP/1.1 reverse proxy in front that allows pipelined response queueing. Apps on managed hosting or apps that do not forward upstream responses unchanged are not described as affected by the sources.
Not affected if managed-hosting, no-upstream-passthrough
Who cares next.js, npm, self-hosted
npm ls next and compare it to the fixed versions.fetch() response object unchanged.Upgrade to 16.4.5 · 15.5.29
Self-hosted Next.js applications (App Router route handlers and the fetch cache) that return a fetched upstream response unchanged can emit a response whose declared framing does not match the body actually sent. When such an application sits behind an HTTP/1.1 reverse proxy that permits pipelined response queueing, a crafted upstream response can desynchronize responses between clients, enabling response injection and disclosure of other clients' responses.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
next 16.x: move to 16.4.5next 15.x: move to 15.5.29