CVE-2026-64648

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10

Description A server-side fetch operation involving a request body may return a cached response body from a separate request directed to the same URL but containing a different body. This can lead to the leakage of confidential data from a POST response body to unauthorized requests. This issue occurs specifically when fetch calls are made where the request object has a different initialization than the one passed to the fetch function, such as fetch(new Request(init), aDifferentInit).

Recommendations Update Next.js versions 12.0.0 through 15.5.20 to version 15.5.21. Update Next.js versions 16.0.0 through 16.2.10 to version 16.2.11.