{"id":"CVE-2026-119790","kind":"vulnerability","aliases":["CVE-2026-119790","GHSA-mfr8-8qww-v76h"],"related":[],"title":"Information disclosure across root params in Next.js when a 'use cache' function is called through unstable_cache()","description":"<!-- https://linear.app/vercel/issue/NSEC-726 -->\r\nNext.js applications with `'use cache'` can disclose cached data across root params when the same `'use cache'` function is called both directly during rendering and through `unstable_cache()`, and that function reads a root param. Root params are route parameters of the root layout, and applications commonly use them to scope data, for example per locale.\r\n\r\nDuring a cold process start, a cross-request deduplication race allowed an `unstable_cache()` call to join the in-flight fill of a concurrent direct call and receive its result, bypassing the root param check that would normally reject it. `unstable_cache()` then stored that result under a cache key without root params, so subsequent requests for other root param values received the same entry until it is revalidated or evicted. Cached data produced for one root param value is returned to requests for other values.\r\n\r\nExploitation requires the `unstable_cache()` request to arrive while the function's first fill after a process start is still in flight. Outside this race, the nesting already throws an error: `'use cache' inside unstable_cache() is unsupported`, and avoiding it is a complete workaround.","summary":"Next.js apps that call a 'use cache' function both directly and through unstable_cache() can, during a race right after process start, store data produced for one root param value and return it to requests for other root param values. An attacker can read cached data scoped to another user's route parameter, such as a locale.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.4.5"],"affected":">= 16.3.0, <= 16.4.4","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["next.js","package","self-hosted","vercel"],"not_affected_if":["default-config","no-root-params","no-unstable-cache"],"how_to_check":"- Look for `'use cache'` functions that read a root param and are also called inside `unstable_cache()` in the app code.\n- Check the installed Next.js version with `npm ls next`; affected versions are `>= 16.3.0` and `<= 16.4.4`.","fix":"- Upgrade `next` to `16.4.5`.\n- Workaround stated by the source: avoid calling a 'use cache' function inside `unstable_cache()`.","status":"open","published_at":"2026-11-03T18:39:36+00:00","first_seen_at":"2026-11-09T22:53:13+00:00","triaged_at":"2026-11-09T22:54:52+00:00","updated_at":"2026-11-09T22:54:52+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:54:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `next` to `16.4.5`.\n- Workaround stated by the source: avoid calling a 'use cache' function inside `unstable_cache()`.","reach":"internet","title":"Next.js: cache race can serve one locale's cached data to other users","impact":"medium","summary":"Next.js apps that call a 'use cache' function both directly and through unstable_cache() can, during a race right after process start, store data produced for one root param value and return it to requests for other root param values. An attacker can read cached data scoped to another user's route parameter, such as a locale.","audience":"developers","category":"package","nicknames":[],"who_cares":["next.js","self-hosted","vercel"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"users read cached data produced for other root param values","analyst_note":"","how_to_check":"- Look for `'use cache'` functions that read a root param and are also called inside `unstable_cache()` in the app code.\n- Check the installed Next.js version with `npm ls next`; affected versions are `>= 16.3.0` and `<= 16.4.4`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-unstable-cache","no-root-params"],"who_is_affected":"Applications on Next.js 16.3.0 through 16.4.4 that use 'use cache' with root params and also call the same cached function through unstable_cache(). Exposure is limited to the window while a function's first fill after a cold start is in flight. Apps without that nesting are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000781,"input_tokens":4892,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119790':20A,28A '-2026':19A,27A '8qww':24A 'across':3A,102C 'allow':160C 'alreadi':264C 'anoth':84B 'app':37B 'applic':94C,138C 'arriv':244C 'attack':77B 'avoid':276C 'bypass':181C 'cach':11A,17A,42B,49B,80B,97C,100C,109C,120C,163C,192C,199C,222C,241C,269C,272C 'call':14A,39B,112C,164C,176C 'check':185C 'cold':151C 'common':139C 'complet':280C 'concurr':174C 'cross':156C 'cross-request':155C 'cve':18A,26A 'data':59B,81B,101C,144C,223C 'dedupl':158C 'direct':45B,114C,175C 'disclos':99C 'disclosur':2A 'entri':215C 'error':267C 'evict':221C 'exampl':146C 'exploit':237C 'fill':171C,250C 'first':249C 'flight':170C,258C 'function':12A,43B,110C,123C,247C 'ghsa':22A 'ghsa-mfr8-8qww-v76h':21A 'host':34B 'in-flight':168C 'inform':1A 'insid':270C 'join':166C 'key':200C 'layout':136C 'local':92B,148C 'mfr8':23A 'nest':263C 'next':29A 'next.js':7A,30B,36B,93C 'normal':188C 'one':62B,226C 'outsid':259C 'packag':31B 'param':5A,64B,74B,104C,127C,129C,184C,203C,210C,228C 'paramet':88B,132C 'per':147C 'process':56B,152C,253C 'produc':60B,224C 'race':53B,159C,261C 'read':79B,124C 'receiv':178C,212C 'reject':189C 'render':116C 'request':70B,157C,206C,233C,242C 'requir':238C 'result':180C,196C 'return':67B,231C 'revalid':219C 'right':54B 'root':4A,63B,73B,103C,126C,128C,135C,183C,202C,209C,227C 'rout':87B,131C 'scope':82B,143C 'self':33B 'self-host':32B 'start':57B,153C,254C 'still':256C 'store':58B,194C 'subsequ':205C 'throw':265C 'unstabl':16A,48B,119C,162C,191C,240C,271C 'unsupport':274C 'use':10A,41B,96C,108C,140C,268C 'user':85B 'v76h':25A 'valu':65B,75B,211C,229C,236C 'vercel':35B 'without':201C 'workaround':281C 'would':187C","nicknames":[],"mitigations":[],"who_affected":"Applications on Next.js 16.3.0 through 16.4.4 that use 'use cache' with root params and also call the same cached function through unstable_cache(). Exposure is limited to the window while a function's first fill after a cold start is in flight. Apps without that nesting are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["next"],"ptokens":["next"],"labels":["medium","nextjs","npm","package","selfhosted","vercel"],"campaign_type":null,"search_a":"'-119790':20A,28A '-2026':19A,27A '8qww':24A 'across':3A 'cach':11A,17A 'call':14A 'cve':18A,26A 'disclosur':2A 'function':12A 'ghsa':22A 'ghsa-mfr8-8qww-v76h':21A 'inform':1A 'mfr8':23A 'next':29A 'next.js':7A 'param':5A 'root':4A 'unstabl':16A 'use':10A 'v76h':25A","search_b":"'anoth':84B 'app':37B 'attack':77B 'cach':42B,49B,80B 'call':39B 'data':59B,81B 'direct':45B 'function':43B 'host':34B 'local':92B 'next.js':30B,36B 'one':62B 'packag':31B 'param':64B,74B 'paramet':88B 'process':56B 'produc':60B 'race':53B 'read':79B 'request':70B 'return':67B 'right':54B 'root':63B,73B 'rout':87B 'scope':82B 'self':33B 'self-host':32B 'start':57B 'store':58B 'unstabl':48B 'use':41B 'user':85B 'valu':65B,75B 'vercel':35B","search_c":"'across':102C 'allow':160C 'alreadi':264C 'applic':94C,138C 'arriv':244C 'avoid':276C 'bypass':181C 'cach':97C,100C,109C,120C,163C,192C,199C,222C,241C,269C,272C 'call':112C,164C,176C 'check':185C 'cold':151C 'common':139C 'complet':280C 'concurr':174C 'cross':156C 'cross-request':155C 'data':101C,144C,223C 'dedupl':158C 'direct':114C,175C 'disclos':99C 'entri':215C 'error':267C 'evict':221C 'exampl':146C 'exploit':237C 'fill':171C,250C 'first':249C 'flight':170C,258C 'function':110C,123C,247C 'in-flight':168C 'insid':270C 'join':166C 'key':200C 'layout':136C 'local':148C 'nest':263C 'next.js':93C 'normal':188C 'one':226C 'outsid':259C 'param':104C,127C,129C,184C,203C,210C,228C 'paramet':132C 'per':147C 'process':152C,253C 'produc':224C 'race':159C,261C 'read':124C 'receiv':178C,212C 'reject':189C 'render':116C 'request':157C,206C,233C,242C 'requir':238C 'result':180C,196C 'return':231C 'revalid':219C 'root':103C,126C,128C,135C,183C,202C,209C,227C 'rout':131C 'scope':143C 'start':153C,254C 'still':256C 'store':194C 'subsequ':205C 'throw':265C 'unstabl':119C,162C,191C,240C,271C 'unsupport':274C 'use':96C,108C,140C,268C 'valu':211C,229C,236C 'without':201C 'workaround':281C 'would':187C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T18:39:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-mfr8-8qww-v76h","url":"https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h","severity":"medium","published_at":"2026-11-03T18:39:36+00:00","modified_at":"2026-11-06T10:20:14+00:00","first_seen_at":"2026-11-09T22:53:13+00:00","fetched_at":"2026-11-09T22:53:13+00:00","note":null}],"documents":[{"id":110392,"url":"https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}