---
id: "CVE-2026-119351"
page: "https://infrastack.ai/live/CVE-2026-119351"
kind: "vulnerability"
aliases: ["CVE-2026-119351", "GHSA-vc7v-qv4w-wrv8"]
title: "Cache leak across root param values in nested 'use cache' functions via delayed inner stream metadata"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "next", "fixed": ["16.4.5"], "affected": ">= 16.2.0, <= 16.4.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["next.js", "package", "self-hosted", "vercel"]
not_affected_if: ["cache-components-disabled", "no-nested-use-cache", "no-root-params"]
published_at: "2026-11-03T18:39:40+00:00"
first_seen_at: "2026-11-09T22:53:13+00:00"
updated_at: "2026-11-09T22:54:53+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8", "first_seen_at": "2026-11-09T22:53:13+00:00"}]
exploit_sources: []
---

# Cache leak across root param values in nested 'use cache' functions via delayed inner stream metadata

Link for people: https://infrastack.ai/live/CVE-2026-119351 (this .md is for agents)

With Cache Components enabled, a nested 'use cache' function can save a cache entry under a key that omits a root param, so one root param value's response can be served for another. Entries written this way can also ignore tag invalidation and cache lifetimes of the nested caches they used.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 16.2.0, <= 16.4.4 fixed 16.4.5

## How to check

- Check the installed version with `npm ls next`
- Look for `cacheComponents` enabled in `next.config`
- Look for `'use cache'` functions that call other `'use cache'` functions and read root params via `next/root-params`

## Fix

- `next` `16.4.5` (fixed; affected range `>= 16.2.0, <= 16.4.4`)

## Timeline

- 2026-11-09T22:53:13+00:00 ghsa-repo https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-vc7v-qv4w-wrv8

## From the sources

<!-- https://linear.app/vercel/issue/NSEC-395 -->

With Cache Components enabled, an outer `'use cache'` function can be keyed incorrectly even when its inner `'use cache'` call generates a fresh entry. If the inner function reads a root param (via `next/root-params`) and returns a value that still contains pending promises — for example an object with data that is ready immediately alongside slower data — React Flight delivers the ready portion to the outer function before the inner entry has finished publishing its root param dependencies. The outer function can then finish, and its cache entry is persisted under a key that omits that root param. The entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value. Entries written this way can also ignore tag invalidation and cache lifetimes of the nested caches they consumed.

What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.

This is a variant of https://github.com/advisories/GHSA-h694-7cp9-m8p3 that the fix for that advisory does not cover: it does not require the inner call to be served from an existing entry, and it does not depend on a slow cache handler.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_