NEXT · CVE-2026-119349 · Runtime
FIX → 16.4.5
Next.js App Router functions marked with the use cache directive can produce identical cache keys for different binary arguments such as Uint8Array or Blob. Cached results can then be served to other users, which discloses data or lets an attacker poison cached responses.
first public Nov 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications on Next.js 16.0.0 through 16.4.4 that use the App Router and pass binary arguments such as Uint8Array or Blob into functions marked with the use cache directive. Apps that do not use use cache, or that only pass strings and plain objects, are not described as affected by the sources.
Not affected if no-binary-arguments, no-use-cache
Who cares app-router, next.js, self-hosted
use cache in App Router code that takes Uint8Array, ArrayBuffer or Blob parameters.npm ls next; affected versions are 16.0.0 through 16.4.4.Upgrade to 16.4.5
16.4.5.Next.js App Router applications that pass binary arguments (such as Uint8Array or Blob values) to functions using the use cache directive can produce identical cache keys for distinct arguments, allowing cached results to be shared across users — cross-user disclosure of cached data or cache poisoning. This affects applications using use cache with binary arguments.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.