{"id":"CVE-2026-119349","kind":"vulnerability","aliases":["CVE-2026-119349","GHSA-rhh4-g77r-r9qj"],"related":[],"title":"Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments","description":"<!-- https://linear.app/vercel/issue/NSEC-546 -->\r\nNext.js App Router applications that pass binary arguments (such as Uint8Array or Blob values) to functions using the `use cache` directive can produce identical cache keys for distinct arguments, allowing cached results to be shared across users — cross-user disclosure of cached data or cache poisoning. This affects applications using `use cache` with binary arguments.","summary":"Next.js App Router functions marked with the use cache directive can produce identical cache keys for different binary arguments such as Uint8Array or Blob. Cached results can then be served to other users, which discloses data or lets an attacker poison cached responses.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.4.5"],"affected":">= 16.0.0, <= 16.4.4","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["app-router","next.js","runtime","self-hosted"],"not_affected_if":["no-binary-arguments","no-use-cache"],"how_to_check":"- Look for `use cache` in App Router code that takes Uint8Array, ArrayBuffer or Blob parameters.\n- Check the installed version with `npm ls next`; affected versions are `16.0.0` through `16.4.4`.","fix":"- Upgrade next to `16.4.5`.","status":"open","published_at":"2026-11-03T18:39:45+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","triaged_at":"2026-11-09T22:54:48+00:00","updated_at":"2026-11-09T22:54:48+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T22:54:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade next to `16.4.5`.","reach":"internet","title":"Next.js: cache keys collide for binary arguments, leaking data between users","impact":"medium","summary":"Next.js App Router functions marked with the use cache directive can produce identical cache keys for different binary arguments such as Uint8Array or Blob. Cached results can then be served to other users, which discloses data or lets an attacker poison cached responses.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["next.js","app-router","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"cached data from one user is served to another user","analyst_note":"","how_to_check":"- Look for `use cache` in App Router code that takes Uint8Array, ArrayBuffer or Blob parameters.\n- Check the installed version with `npm ls next`; affected versions are `16.0.0` through `16.4.4`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-use-cache","no-binary-arguments"],"who_is_affected":"Applications on Next.js 16.0.0 through 16.4.4 that use the App Router and pass binary arguments such as Uint8Array or Blob into functions marked with the use cache directive. Apps that do not use use cache, or that only pass strings and plain objects, are not described as affected by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4668,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119349':17A,25A '-2026':16A,24A 'across':113C 'affect':126C 'allow':107C 'app':28B,36B,79C 'app-rout':27B 'applic':81C,127C 'argument':14A,53B,85C,106C,133C 'attack':74B 'binari':13A,52B,84C,132C 'blob':58B,90C 'cach':4A,11A,43B,48B,59B,76B,97C,102C,108C,120C,123C,130C 'cross':2A,116C 'cross-us':1A,115C 'cve':15A,23A 'data':70B,121C 'differ':51B 'direct':44B,98C 'disclos':69B 'disclosur':5A,118C 'distinct':105C 'function':38B,93C 'g77r':21A 'ghsa':19A 'ghsa-rhh4-g77r-r9qj':18A 'host':34B 'ident':47B,101C 'key':49B,103C 'let':72B 'mark':39B 'next':26A 'next.js':9A,30B,35B,78C 'pass':83C 'poison':7A,75B,124C 'produc':46B,100C 'r9qj':22A 'respons':77B 'result':60B,109C 'rhh4':20A 'router':29B,37B,80C 'runtim':31B 'self':33B 'self-host':32B 'serv':64B 'share':112C 'uint8array':56B,88C 'use':10A,42B,94C,96C,128C,129C 'user':3A,67B,114C,117C 'valu':91C","nicknames":[],"mitigations":[],"who_affected":"Applications on Next.js 16.0.0 through 16.4.4 that use the App Router and pass binary arguments such as Uint8Array or Blob into functions marked with the use cache directive. Apps that do not use use cache, or that only pass strings and plain objects, are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["next"],"ptokens":["next"],"labels":["approuter","medium","nextjs","npm","runtime","selfhosted"],"campaign_type":null,"search_a":"'-119349':17A,25A '-2026':16A,24A 'argument':14A 'binari':13A 'cach':4A,11A 'cross':2A 'cross-us':1A 'cve':15A,23A 'disclosur':5A 'g77r':21A 'ghsa':19A 'ghsa-rhh4-g77r-r9qj':18A 'next':26A 'next.js':9A 'poison':7A 'r9qj':22A 'rhh4':20A 'use':10A 'user':3A","search_b":"'app':28B,36B 'app-rout':27B 'argument':53B 'attack':74B 'binari':52B 'blob':58B 'cach':43B,48B,59B,76B 'data':70B 'differ':51B 'direct':44B 'disclos':69B 'function':38B 'host':34B 'ident':47B 'key':49B 'let':72B 'mark':39B 'next.js':30B,35B 'poison':75B 'produc':46B 'respons':77B 'result':60B 'router':29B,37B 'runtim':31B 'self':33B 'self-host':32B 'serv':64B 'uint8array':56B 'use':42B 'user':67B","search_c":"'across':113C 'affect':126C 'allow':107C 'app':79C 'applic':81C,127C 'argument':85C,106C,133C 'binari':84C,132C 'blob':90C 'cach':97C,102C,108C,120C,123C,130C 'cross':116C 'cross-us':115C 'data':121C 'direct':98C 'disclosur':118C 'distinct':105C 'function':93C 'ident':101C 'key':103C 'next.js':78C 'pass':83C 'poison':124C 'produc':100C 'result':109C 'router':80C 'share':112C 'uint8array':88C 'use':94C,96C,128C,129C 'user':114C,117C 'valu':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T18:39:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-rhh4-g77r-r9qj","url":"https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj","severity":"medium","published_at":"2026-11-03T18:39:45+00:00","modified_at":"2026-11-06T10:20:05+00:00","first_seen_at":"2026-11-09T22:53:14+00:00","fetched_at":"2026-11-09T22:53:14+00:00","note":null}],"documents":[{"id":110395,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}