{"id":"CVE-2026-119351","kind":"vulnerability","aliases":["CVE-2026-119351","GHSA-vc7v-qv4w-wrv8"],"related":[],"title":"Cache leak across root param values in nested 'use cache' functions via delayed inner stream metadata","description":"<!-- https://linear.app/vercel/issue/NSEC-395 -->\r\n\r\nWith Cache Components enabled, an outer `'use cache'` function can be keyed incorrectly even when its inner `'use cache'` call generates a fresh entry. If the inner function reads a root param (via `next/root-params`) and returns a value that still contains pending promises — for example an object with data that is ready immediately alongside slower data — React Flight delivers the ready portion to the outer function before the inner entry has finished publishing its root param dependencies. The outer function can then finish, and its cache entry is persisted under a key that omits that root param. The entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value. Entries written this way can also ignore tag invalidation and cache lifetimes of the nested caches they consumed.\r\n\r\nWhat values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.\r\n\r\nThis is a variant of https://github.com/advisories/GHSA-h694-7cp9-m8p3 that the fix for that advisory does not cover: it does not require the inner call to be served from an existing entry, and it does not depend on a slow cache handler.","summary":"With Cache Components enabled, a nested 'use cache' function can save a cache entry under a key that omits a root param, so one root param value's response can be served for another. Entries written this way can also ignore tag invalidation and cache lifetimes of the nested caches they used.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.4.5"],"affected":">= 16.2.0, <= 16.4.4","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["next.js","package","self-hosted","vercel"],"not_affected_if":["cache-components-disabled","no-nested-use-cache","no-root-params"],"how_to_check":"- Check the installed version with `npm ls next`\n- Look for `cacheComponents` enabled in `next.config`\n- Look for `'use cache'` functions that call other `'use cache'` functions and read root params via `next/root-params`","fix":"- `next` `16.4.5` (fixed; affected range `>= 16.2.0, <= 16.4.4`)","status":"open","published_at":"2026-11-03T18:39:40+00:00","first_seen_at":"2026-11-09T22:53:13+00:00","triaged_at":"2026-11-09T22:54:53+00:00","updated_at":"2026-11-09T22:54:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:54:53Z","model":"claude-haiku-5-5","output":{"fix":"- `next` `16.4.5` (fixed; affected range `>= 16.2.0, <= 16.4.4`)","reach":"internet","title":"Next.js: nested cache entries can serve one root param's content to others","impact":"medium","summary":"With Cache Components enabled, a nested 'use cache' function can save a cache entry under a key that omits a root param, so one root param value's response can be served for another. Entries written this way can also ignore tag invalidation and cache lifetimes of the nested caches they used.","audience":"developers","category":"package","nicknames":[],"who_cares":["next.js","self-hosted","vercel"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"cached responses for one root param value are served to other users","analyst_note":"","how_to_check":"- Check the installed version with `npm ls next`\n- Look for `cacheComponents` enabled in `next.config`\n- Look for `'use cache'` functions that call other `'use cache'` functions and read root params via `next/root-params`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["cache-components-disabled","no-root-params","no-nested-use-cache"],"who_is_affected":"Applications on Next.js 16.2.0 through 16.4.4 that enable Cache Components and nest 'use cache' functions that read root params. Apps that do not enable Cache Components, or that do not use root params inside nested cached functions, are not described as exposed by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4925,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119351':19A,27A '-2026':18A,26A '/advisories/ghsa-h694-7cp9-m8p3':260C 'across':3A 'advisori':266C 'alongsid':140C 'also':74B,217C 'anoth':68B 'attack':236C 'cach':1A,10A,36B,42B,47B,79B,84B,88C,94C,105C,172C,222C,227C,292C 'call':106C,276C 'cannot':234C 'compon':37B,89C 'consum':229C 'contain':127C 'content':206C,241C 'control':237C 'cover':269C 'cve':17A,25A 'data':135C,142C 'delay':13A 'deliv':145C 'depend':163C,244C,288C 'differ':210C 'enabl':38B,90C 'entri':48B,69B,110C,156C,173C,185C,212C,251C,283C 'even':100C 'exampl':131C 'exist':282C 'finish':158C,169C 'first':252C 'fix':263C 'flight':144C 'fresh':109C 'function':11A,43B,95C,114C,152C,166C 'generat':107C 'ghsa':21A 'ghsa-vc7v-qv4w-wrv8':20A 'github.com':259C 'github.com/advisories/ghsa-h694-7cp9-m8p3':258C 'handler':293C 'host':33B 'ignor':75B,218C 'immedi':139C 'incorrect':99C 'inner':14A,103C,113C,155C,275C 'invalid':77B,220C 'invoc':248C 'key':51B,98C,178C 'leak':2A,233C 'lifetim':80B,223C 'metadata':16A 'nest':8A,40B,83B,226C 'next':28A 'next.js':29B 'next/root-params':120C 'object':133C 'omit':53B,180C 'one':58B,200C 'outer':92C,151C,165C 'packag':30B 'param':5A,56B,60B,118C,162C,183C,194C,202C 'pend':128C 'persist':175C 'portion':148C 'produc':207C 'promis':129C 'publish':159C 'qv4w':23A 'react':143C 'read':115C 'readi':138C,147C 'requir':273C 'respons':63B,198C 'return':122C 'reus':190C 'root':4A,55B,59B,117C,161C,182C,193C,201C 'save':45B 'self':32B 'self-host':31B 'serv':66B,205C,243C,279C 'slow':291C 'slower':141C 'still':126C 'stream':15A 'tag':76B,219C 'use':9A,41B,86B,93C,104C 'valu':6A,61B,124C,195C,203C,211C,231C,239C 'variant':256C 'vc7v':22A 'vercel':34B 'via':12A,119C 'way':72B,215C 'written':70B,187C,213C 'wrote':249C 'wrv8':24A","nicknames":[],"mitigations":[],"who_affected":"Applications on Next.js 16.2.0 through 16.4.4 that enable Cache Components and nest 'use cache' functions that read root params. Apps that do not enable Cache Components, or that do not use root params inside nested cached functions, are not described as exposed by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["next"],"ptokens":["next"],"labels":["medium","nextjs","npm","package","selfhosted","vercel"],"campaign_type":null,"search_a":"'-119351':19A,27A '-2026':18A,26A 'across':3A 'cach':1A,10A 'cve':17A,25A 'delay':13A 'function':11A 'ghsa':21A 'ghsa-vc7v-qv4w-wrv8':20A 'inner':14A 'leak':2A 'metadata':16A 'nest':8A 'next':28A 'param':5A 'qv4w':23A 'root':4A 'stream':15A 'use':9A 'valu':6A 'vc7v':22A 'via':12A 'wrv8':24A","search_b":"'also':74B 'anoth':68B 'cach':36B,42B,47B,79B,84B 'compon':37B 'enabl':38B 'entri':48B,69B 'function':43B 'host':33B 'ignor':75B 'invalid':77B 'key':51B 'lifetim':80B 'nest':40B,83B 'next.js':29B 'omit':53B 'one':58B 'packag':30B 'param':56B,60B 'respons':63B 'root':55B,59B 'save':45B 'self':32B 'self-host':31B 'serv':66B 'tag':76B 'use':41B,86B 'valu':61B 'vercel':34B 'way':72B 'written':70B","search_c":"'/advisories/ghsa-h694-7cp9-m8p3':260C 'advisori':266C 'alongsid':140C 'also':217C 'attack':236C 'cach':88C,94C,105C,172C,222C,227C,292C 'call':106C,276C 'cannot':234C 'compon':89C 'consum':229C 'contain':127C 'content':206C,241C 'control':237C 'cover':269C 'data':135C,142C 'deliv':145C 'depend':163C,244C,288C 'differ':210C 'enabl':90C 'entri':110C,156C,173C,185C,212C,251C,283C 'even':100C 'exampl':131C 'exist':282C 'finish':158C,169C 'first':252C 'fix':263C 'flight':144C 'fresh':109C 'function':95C,114C,152C,166C 'generat':107C 'github.com':259C 'github.com/advisories/ghsa-h694-7cp9-m8p3':258C 'handler':293C 'ignor':218C 'immedi':139C 'incorrect':99C 'inner':103C,113C,155C,275C 'invalid':220C 'invoc':248C 'key':98C,178C 'leak':233C 'lifetim':223C 'nest':226C 'next/root-params':120C 'object':133C 'omit':180C 'one':200C 'outer':92C,151C,165C 'param':118C,162C,183C,194C,202C 'pend':128C 'persist':175C 'portion':148C 'produc':207C 'promis':129C 'publish':159C 'react':143C 'read':115C 'readi':138C,147C 'requir':273C 'respons':198C 'return':122C 'reus':190C 'root':117C,161C,182C,193C,201C 'serv':205C,243C,279C 'slow':291C 'slower':141C 'still':126C 'tag':219C 'use':93C,104C 'valu':124C,195C,203C,211C,231C,239C 'variant':256C 'via':119C 'way':215C 'written':187C,213C 'wrote':249C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T18:39:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-vc7v-qv4w-wrv8","url":"https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8","severity":"medium","published_at":"2026-11-03T18:39:40+00:00","modified_at":"2026-11-06T10:20:10+00:00","first_seen_at":"2026-11-09T22:53:13+00:00","fetched_at":"2026-11-09T22:53:13+00:00","note":null}],"documents":[{"id":110393,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}