GHSA-4633-3j49-mh5q

Suggest an improvement
Source
https://github.com/advisories/GHSA-4633-3j49-mh5q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-4633-3j49-mh5q/GHSA-4633-3j49-mh5q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4633-3j49-mh5q
Aliases
Downstream
Published
2026-07-22T23:06:12Z
Modified
2026-09-10T03:50:51Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Details

Impact

A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.

This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache.

Workarounds

If you cannot upgrade, consider only making fetch requests with UTF-8 bodies (default in Next.js). Applications using Pages Router are not vulnerable.

Database specific 
{
    "cwe_ids": [
        "CWE-116"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T23:06:12Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
13.0.0
Fixed
15.5.21

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-4633-3j49-mh5q/GHSA-4633-3j49-mh5q.json"

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
16.0.0
Fixed
16.2.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-4633-3j49-mh5q/GHSA-4633-3j49-mh5q.json"