Next.js patches seven cache and cookie flaws in 16.4.5 and 15.5.29

Next.js patches seven cache and cookie flaws in 16.4.5 and 15.5.29

10 November 2026: Next.js 16.4.5 and 15.5.29 close seven medium-severity flaws, CVE-2026-119346 to 119351 and CVE-2026-119790, most of them in caching and several able to return one user's data to another. Self-hosted applications are the ones most named in the advisories, no exploitation has been reported, and the fix is to upgrade.

Not yet independently verified. The seven entries come from the advisory list the Next.js project publishes on GitHub. We found no report of exploitation, and none of the seven numbers was in CISA's catalogue at its 9 November update. We will update this when it can be confirmed, and remove this note.

Three flaws where cached data crosses between users

The newest caching features carry most of the risk. Under CVE-2026-119349, passing binary arguments such as a Uint8Array or Blob to a function marked use cache can produce identical cache keys for different arguments, so a result cached for one user can be returned to another, or poisoned. It affects 16.0.0 to 16.4.4.

CVE-2026-119351 and CVE-2026-119790 both concern root params, the route parameters of a root layout that applications often use to separate locales or tenants. In the first, a nested use cache call can leave an entry written once and reused for every root param value, ignoring tag invalidation as well. In the second, a race during a cold process start lets unstable_cache() store a result without its root params. An application that separates customers by root param should treat both as tenant isolation problems rather than as cosmetic cache bugs. They affect 16.2.0 and 16.3.0 upward respectively.

A session cookie that scripts can read

CVE-2026-119346 applies when an application sets cookies through NextResponse on Edge runtime routes. The internal x-middleware-set-cookie header goes out in the public response and repeats the cookie, which makes an HttpOnly value readable by JavaScript on the same origin. HttpOnly exists to stop precisely that. Any session token set this way lost its protection against a cross-site scripting bug elsewhere on the site, on versions from 15.0.0.

Two that depend on how the site is hosted

Self-hosted deployments behind an HTTP/1.1 reverse proxy that permits pipelined response queueing are the target of CVE-2026-119348. A route handler that returns a fetched upstream response unchanged can send a body that does not match its declared framing, which desynchronises responses between clients. One unauthenticated GET request can poison a shared fallback shell under CVE-2026-119350, where an application runs next start with cacheComponents: true and without Partial Prefetching. The stored result can be a persistent 404 across a family of routes.

CVE-2026-119347 lets an attacker push an SVG through /_next/image on self-hosted sites even with dangerouslyAllowSVG set to false, the default. That reaches a parser the application meant to keep switched off, the same area as the critical Image Optimization flaw patched in October.

Fixed versions

• 16.0.0 to 16.4.4: upgrade to 16.4.5 (all seven, within the ranges above)
• 15.0.0 to 15.5.28: upgrade to 15.5.29 (CVE-2026-119346 and 119347)
• 15.5.28 and earlier: 15.5.29 also fixes CVE-2026-119348

CVSS 4.0 scores run from 6.0 to 6.9. CVE-2026-119347 scores highest at 6.9, and the cookie exposure scores 6.0 because it needs a user action and a harder set of conditions.

After upgrading, purge the persistent cache. A poisoned or cross-keyed entry written before the patch can otherwise stay in place until it is revalidated or evicted. We list Vercel, the company behind the framework, in our web hosting software category.

Related on TrustList:

• Next.js 16.4.1 fixes two critical flaws that need no login to exploit
• Next.js flaw in next/og ImageResponse allows remote code execution: upgrade to 16.3.6
• Deno Deploy to shut in six months as Deno team joins Cloudflare

Sources

• Next.js security advisories on GitHub (GHSA-f3mh-rxg3-f5g2, 7qx7-33qx-rqx2, pc58-hwjq-p385, rhh4-g77r-r9qj, vvgp-ww4w-46vf, vc7v-qv4w-wrv8, mfr8-8qww-v76h), 3 November 2026
• CISA Known Exploited Vulnerabilities catalogue (read 10 November 2026), 9 November 2026