CVE-2026-64647

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10

Description A server-side fetch operation involving a request body may return a cached response body from a different request sent to the same URL but with a different body. This can lead to the leakage of confidential data from a POST response body to unauthorized requests. This issue occurs specifically when request bodies use a content type charset other than UTF-8, causing different byte sequences to share the same cache.

Recommendations Update to version 15.5.21 or later. Update to version 16.2.11 or later. As a temporary workaround, ensure all fetch requests use UTF-8 bodies.