CVE-2026-64647: Next.js Information Disclosure Vulnerability

CVE-2026-64647 Overview

CVE-2026-64647 is an information disclosure vulnerability in Vercel Next.js, a React framework used for building full-stack web applications. The flaw affects versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. A server-side fetch call with a request body may return a cached response body from a different request sent to the same URL but with a different body. This causes confidential data from a POST response to leak to unauthorized requests. The issue only occurs when request bodies use a content type charset other than UTF-8, such as UTF-16. The vulnerability has been fixed in versions 15.5.21 and 16.2.11.

Critical Impact
Confidential POST response bodies can leak to unauthorized requests through improper fetch cache key generation for non-UTF-8 encoded bodies.

Affected Products

Vercel Next.js versions 12.0.0 through 15.5.20
Vercel Next.js versions 16.0.0 through 16.2.10
Applications using server-side fetch with non-UTF-8 request body encodings

Discovery Timeline

2026-07-27 - CVE-2026-64647 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64647

Vulnerability Analysis

The vulnerability resides in the Next.js incremental cache subsystem responsible for generating cache keys for server-side fetch requests. When Next.js constructs a cache key for a fetch call that includes a request body, the key derivation does not account for the byte-exact representation of bodies encoded with non-UTF-8 charsets. Two distinct requests to the same URL with different bodies can therefore collide on the same cache key. The server returns the previously cached POST response body to a subsequent unrelated request. This falls under improper output encoding or escaping [CWE-116].

Root Cause

The cache key generation logic in packages/next/src/server/lib/patch-fetch.ts normalized request bodies through a text-oriented path that assumed UTF-8. Non-UTF-8 byte sequences that decode to visually distinct strings could produce identical cache key inputs. For example, the UTF-16 byte sequences representing 삃삃 and 섄섄 collapse to the same cached entry. The upstream request itself is not deduped, but the response body served to the client is drawn from the shared cache slot.

Attack Vector

An attacker sends a request whose body shares a colliding cache key with a prior privileged POST request. The Next.js server returns the cached response body from the earlier request, exposing data the attacker did not originate. Exploitation requires network access to the vulnerable application and knowledge of an application flow that caches sensitive POST responses using non-UTF-8 charset bodies.

typescript

              fetchUrl,
              isRequestInput ? (input as RequestInit) : init
            )
-          } catch (err) {
-            console.error(`Failed to generate cache key for`, input)
+          } catch (cause) {
+            console.error(`Failed to generate cache key for`, input, cause)
          }
        }

Source: GitHub Commit 025bf4a — the patch enforces a byte-exact fetch cache key for binary bodies and improves error surfacing when key generation fails.

Detection Methods for CVE-2026-64647

Indicators of Compromise

Server logs showing repeated POST requests to the same endpoint with response bodies that do not match request context.
Application-layer telemetry indicating users receiving data belonging to another session or tenant.
Fetch cache hits recorded for requests declaring charset=utf-16 or other non-UTF-8 encodings.
Error messages containing Failed to generate cache key for in Next.js server output.

Detection Strategies

Inventory running Next.js versions and flag any instance within the vulnerable ranges 12.0.0–15.5.20 or 16.0.0–16.2.10.
Instrument server-side fetch calls to log the effective cache key and body charset for cross-request correlation.
Review application code for POST endpoints returning sensitive data that may be reached through Next.js server-side data fetching.

Monitoring Recommendations

Alert on Next.js runtime errors originating from patch-fetch.ts and incremental cache modules.
Monitor outbound fetch traffic from Next.js servers for request bodies using non-UTF-8 charsets.
Track deviations in cache hit ratios and anomalous response size distributions on cached POST endpoints.

How to Mitigate CVE-2026-64647

Immediate Actions Required

Upgrade Next.js to version 15.5.21 or 16.2.11 on all production and staging deployments.
Audit application code paths that issue server-side fetch calls with POST bodies containing sensitive data.
Rotate any credentials or tokens that may have been transmitted through cached POST responses.

Patch Information

Vercel released fixed builds in Next.js v15.5.21 and Next.js v16.2.11. The corrective change is tracked in pull request #96008 and applied in commit 025bf4a. Full disclosure details appear in GitHub Security Advisory GHSA-4633-3j49-mh5q.

Workarounds

Force UTF-8 encoding on all server-side fetch request bodies until upgrade is complete.
Disable the Next.js fetch cache for endpoints returning sensitive POST responses by setting cache: 'no-store' on affected fetch calls.
Route sensitive POST traffic through a non-cached API layer that bypasses the Next.js incremental cache.

bash

# Upgrade Next.js to a patched release
npm install next@15.5.21
# or, for the 16.x branch
npm install next@16.2.11