---
id: "CVE-2026-119790"
page: "https://infrastack.ai/live/CVE-2026-119790"
kind: "vulnerability"
aliases: ["CVE-2026-119790", "GHSA-mfr8-8qww-v76h"]
title: "Information disclosure across root params in Next.js when a 'use cache' function is called through unstable_cache()"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "next", "fixed": ["16.4.5"], "affected": ">= 16.3.0, <= 16.4.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["next.js", "package", "self-hosted", "vercel"]
not_affected_if: ["default-config", "no-root-params", "no-unstable-cache"]
published_at: "2026-11-03T18:39:36+00:00"
first_seen_at: "2026-11-09T22:53:13+00:00"
updated_at: "2026-11-09T22:54:52+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h", "first_seen_at": "2026-11-09T22:53:13+00:00"}]
exploit_sources: []
---

# Information disclosure across root params in Next.js when a 'use cache' function is called through unstable_cache()

Link for people: https://infrastack.ai/live/CVE-2026-119790 (this .md is for agents)

Next.js apps that call a 'use cache' function both directly and through unstable_cache() can, during a race right after process start, store data produced for one root param value and return it to requests for other root param values. An attacker can read cached data scoped to another user's route parameter, such as a locale.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:next affected >= 16.3.0, <= 16.4.4 fixed 16.4.5

## How to check

- Look for `'use cache'` functions that read a root param and are also called inside `unstable_cache()` in the app code.
- Check the installed Next.js version with `npm ls next`; affected versions are `>= 16.3.0` and `<= 16.4.4`.

## Fix

- Upgrade `next` to `16.4.5`.
- Workaround stated by the source: avoid calling a 'use cache' function inside `unstable_cache()`.

## Timeline

- 2026-11-09T22:53:13+00:00 ghsa-repo https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vercel/next.js/security/advisories/GHSA-mfr8-8qww-v76h

## From the sources

<!-- https://linear.app/vercel/issue/NSEC-726 -->
Next.js applications with `'use cache'` can disclose cached data across root params when the same `'use cache'` function is called both directly during rendering and through `unstable_cache()`, and that function reads a root param. Root params are route parameters of the root layout, and applications commonly use them to scope data, for example per locale.

During a cold process start, a cross-request deduplication race allowed an `unstable_cache()` call to join the in-flight fill of a concurrent direct call and receive its result, bypassing the root param check that would normally reject it. `unstable_cache()` then stored that result under a cache key without root params, so subsequent requests for other root param values received the same entry until it is revalidated or evicted. Cached data produced for one root param value is returned to requests for other values.

Exploitation requires the `unstable_cache()` request to arrive while the function's first fill after a process start is still in flight. Outside this race, the nesting already throws an error: `'use cache' inside unstable_cache() is unsupported`, and avoiding it is a complete workaround.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_