EUVD-2026-90872

next.js cache leak across root param values in nested 'use cache' functions...

CVE-2026-103004

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004

Next.js versions from 16.3.0 to 16.3.7 warm "use cache" handlers using "next/root-params" and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root para...

CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-103004

Next.js versions 16.3.0 to 16.3.7 are vulnerable to a cache leak when use cache handlers access next/root-params with Cache Components enabled. The root cause is an incorrect cache key generation: if an inner use cache function reads a root param and is served from an existing entry, the enclosin...

PT-2026-103896

Name of the Vulnerable Software and Affected Versions Next.js versions 16.3.0 through 16.3.7 Description When Cache Components are enabled via cacheComponents: true, use cache handlers using next/root-params may leak return values to pages with different root parameters. This occurs when a use...

CVE-2026-103004: Use of Cache Containing Sensitive Information

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...