GHSA-68g3-v927-f742

Suggest an improvement
Source
https://github.com/advisories/GHSA-68g3-v927-f742
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-68g3-v927-f742/GHSA-68g3-v927-f742.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-68g3-v927-f742
Aliases
Downstream
CGA (28)
MINI (4)
Published
2026-07-22T23:08:17Z
Modified
2026-09-10T03:51:10Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Next.js: Cache confusion of response bodies for requests with bodies
Details

Impact

A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.

This only applies to fetch calls with a request that has a different init than the one passed to fetch. Safe: fetch(new Request(init), init) Unsafe: fetch(new Request(init), aDifferentInit)

Workarounds

No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.

Database specific 
{
    "cwe_ids":  [
        "CWE-524"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-22T23:08:17Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
13.0.0
Fixed
15.5.21

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-68g3-v927-f742/GHSA-68g3-v927-f742.json"

npm / next

Package

Name
next
View open source insights on deps.dev
Purl
pkg:npm/next

Affected ranges

Type
SEMVER
Events
Introduced
16.0.0
Fixed
16.2.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-68g3-v927-f742/GHSA-68g3-v927-f742.json"