CVE-2026-119346

Next.js applications that set cookies through NextResponse on Edge runtime routes — App Router route handlers and Pages Router Edge API routes — send an internal x-middleware-set-cookie header in the public response, duplicating the cookie value and its attributes. This makes HttpOnly cookies, su...