CVE-2026-64648

CVE-2026-64648 — Next.js server-side fetch body cache confusion . The issue affects Next.js versions 12.0.0–15.5.20 and 16.0.0–16.2.10, where a server-side fetch with a request body can cause a cached response body from a different request to the same URL to be returned, leaking confidential data...