---
id: "CVE-2026-119349"
page: "https://infrastack.ai/live/CVE-2026-119349"
kind: "vulnerability"
aliases: ["CVE-2026-119349", "GHSA-rhh4-g77r-r9qj"]
title: "Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "next", "fixed": ["16.4.5"], "affected": ">= 16.0.0, <= 16.4.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["app-router", "next.js", "runtime", "self-hosted"]
not_affected_if: ["no-binary-arguments", "no-use-cache"]
published_at: "2026-11-03T18:39:45+00:00"
first_seen_at: "2026-11-09T22:53:14+00:00"
updated_at: "2026-11-09T22:54:48+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj", "first_seen_at": "2026-11-09T22:53:14+00:00"}]
exploit_sources: []
---

# Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Link for people: https://infrastack.ai/live/CVE-2026-119349 (this .md is for agents)

Next.js App Router functions marked with the use cache directive can produce identical cache keys for different binary arguments such as Uint8Array or Blob. Cached results can then be served to other users, which discloses data or lets an attacker poison cached responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 16.0.0, <= 16.4.4 fixed 16.4.5

## How to check

- Look for `use cache` in App Router code that takes Uint8Array, ArrayBuffer or Blob parameters.
- Check the installed version with `npm ls next`; affected versions are `16.0.0` through `16.4.4`.

## Fix

- Upgrade next to `16.4.5`.

## Timeline

- 2026-11-09T22:53:14+00:00 ghsa-repo https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-rhh4-g77r-r9qj

## From the sources

<!-- https://linear.app/vercel/issue/NSEC-546 -->
Next.js App Router applications that pass binary arguments (such as Uint8Array or Blob values) to functions using the `use cache` directive can produce identical cache keys for distinct arguments, allowing cached results to be shared across users — cross-user disclosure of cached data or cache poisoning. This affects applications using `use cache` with binary arguments.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_