{"id":"CVE-2026-119348","kind":"vulnerability","aliases":["CVE-2026-119348","GHSA-pc58-hwjq-p385"],"related":[],"title":"Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses","description":"<!-- https://linear.app/vercel/issue/NSEC-564 -->\r\nSelf-hosted Next.js applications (App Router route handlers and the fetch cache) that return a fetched upstream response unchanged can emit a response whose declared framing does not match the body actually sent. When such an application sits behind an HTTP/1.1 reverse proxy that permits pipelined response queueing, a crafted upstream response can desynchronize responses between clients, enabling response injection and disclosure of other clients' responses.","summary":"Self-hosted Next.js apps that pass a fetched upstream response through unchanged can send a response whose framing does not match its body. Behind an HTTP/1.1 reverse proxy that allows pipelined responses, an attacker can desynchronize responses and read or inject another client's responses.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.4.5"],"affected":">= 16.0.0, <= 16.4.4","ecosystem":"npm"},{"name":"next","fixed":["15.5.29"],"affected":"<= 15.5.28","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["next.js","npm","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-upstream-passthrough"],"how_to_check":"- Check the installed version with `npm ls next` and compare it to the fixed versions.\n- Look for App Router route handlers or fetch-cache code that returns a `fetch()` response object unchanged.\n- Check whether the app sits behind an HTTP/1.1 reverse proxy that permits pipelined response queueing.","fix":"- `next` 16.x: move to `16.4.5`\n- `next` 15.x: move to `15.5.29`","status":"open","published_at":"2026-11-03T18:39:48+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","triaged_at":"2026-11-09T22:54:48+00:00","updated_at":"2026-11-09T22:54:48+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T22:54:48Z","model":"claude-haiku-5-5","output":{"fix":"- `next` 16.x: move to `16.4.5`\n- `next` 15.x: move to `15.5.29`","reach":"network","title":"Next.js: forwarded upstream responses can leak to other clients behind proxies","impact":"medium","summary":"Self-hosted Next.js apps that pass a fetched upstream response through unchanged can send a response whose framing does not match its body. Behind an HTTP/1.1 reverse proxy that allows pipelined responses, an attacker can desynchronize responses and read or inject another client's responses.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["next.js","self-hosted","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker reads or injects other clients' HTTP responses","analyst_note":"","how_to_check":"- Check the installed version with `npm ls next` and compare it to the fixed versions.\n- Look for App Router route handlers or fetch-cache code that returns a `fetch()` response object unchanged.\n- Check whether the app sits behind an HTTP/1.1 reverse proxy that permits pipelined response queueing.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-upstream-passthrough"],"who_is_affected":"Self-hosted Next.js applications that use App Router route handlers or the fetch cache and return a fetched upstream response unchanged. Exposure also depends on an HTTP/1.1 reverse proxy in front that allows pipelined response queueing. Apps on managed hosting or apps that do not forward upstream responses unchanged are not described as affected by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000777,"input_tokens":4719,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119348':19A,27A '-2026':18A,26A 'actual':114C 'allow':66B 'anoth':78B 'app':40B,87C 'applic':13A,86C,119C 'attack':70B 'behind':60B,121C 'bodi':59B,113C 'cach':94C 'client':3A,79B,139C,147C 'craft':132C 'cross':2A 'cross-client':1A 'cve':17A,25A 'declar':107C 'desynchron':72B,136C 'disclosur':7A,144C 'emit':103C 'enabl':140C 'fetch':15A,44B,93C,98C 'forward':14A 'frame':54B,108C 'ghsa':21A 'ghsa-pc58-hwjq-p385':20A 'handler':90C 'host':11A,35B,38B,84C 'http/1.1':62B,123C 'hwjq':23A 'inject':5A,77B,142C 'match':57B,111C 'next':28A,29A 'next.js':12A,30B,39B,85C 'npm':31B 'p385':24A 'pass':42B 'pc58':22A 'permit':127C 'pipelin':67B,128C 'proxi':64B,125C 'queue':130C 'read':75B 'respons':4A,16A,46B,52B,68B,73B,81B,100C,105C,129C,134C,137C,141C,148C 'return':96C 'revers':63B,124C 'rout':89C 'router':88C 'runtim':32B 'self':10A,34B,37B,83C 'self-host':9A,33B,36B,82C 'send':50B 'sent':115C 'sit':120C 'unchang':48B,101C 'upstream':45B,99C,133C 'whose':53B,106C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Next.js applications that use App Router route handlers or the fetch cache and return a fetched upstream response unchanged. Exposure also depends on an HTTP/1.1 reverse proxy in front that allows pipelined response queueing. Apps on managed hosting or apps that do not forward upstream responses unchanged are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["next"],"ptokens":["next"],"labels":["medium","nextjs","npm","runtime","selfhosted"],"campaign_type":null,"search_a":"'-119348':19A,27A '-2026':18A,26A 'applic':13A 'client':3A 'cross':2A 'cross-client':1A 'cve':17A,25A 'disclosur':7A 'fetch':15A 'forward':14A 'ghsa':21A 'ghsa-pc58-hwjq-p385':20A 'host':11A 'hwjq':23A 'inject':5A 'next':28A,29A 'next.js':12A 'p385':24A 'pc58':22A 'respons':4A,16A 'self':10A 'self-host':9A","search_b":"'allow':66B 'anoth':78B 'app':40B 'attack':70B 'behind':60B 'bodi':59B 'client':79B 'desynchron':72B 'fetch':44B 'frame':54B 'host':35B,38B 'http/1.1':62B 'inject':77B 'match':57B 'next.js':30B,39B 'npm':31B 'pass':42B 'pipelin':67B 'proxi':64B 'read':75B 'respons':46B,52B,68B,73B,81B 'revers':63B 'runtim':32B 'self':34B,37B 'self-host':33B,36B 'send':50B 'unchang':48B 'upstream':45B 'whose':53B","search_c":"'actual':114C 'app':87C 'applic':86C,119C 'behind':121C 'bodi':113C 'cach':94C 'client':139C,147C 'craft':132C 'declar':107C 'desynchron':136C 'disclosur':144C 'emit':103C 'enabl':140C 'fetch':93C,98C 'frame':108C 'handler':90C 'host':84C 'http/1.1':123C 'inject':142C 'match':111C 'next.js':85C 'permit':127C 'pipelin':128C 'proxi':125C 'queue':130C 'respons':100C,105C,129C,134C,137C,141C,148C 'return':96C 'revers':124C 'rout':89C 'router':88C 'self':83C 'self-host':82C 'sent':115C 'sit':120C 'unchang':101C 'upstream':99C,133C 'whose':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T18:39:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-pc58-hwjq-p385","url":"https://github.com/vercel/next.js/security/advisories/GHSA-pc58-hwjq-p385","severity":"medium","published_at":"2026-11-03T18:39:48+00:00","modified_at":"2026-11-06T10:20:08+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","fetched_at":"2026-11-09T22:53:14+00:00","note":null}],"documents":[{"id":110394,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-pc58-hwjq-p385","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}