{"id":"ghsa-ghsa-h694-7cp9-m8p3","seq":309585,"kind":"advisory","title":"next.js cache leak across root param values in nested 'use cache' functions","url":"https://github.com/advisories/GHSA-h694-7cp9-m8p3","permalink":"https://vulnpulse.app/items/ghsa-ghsa-h694-7cp9-m8p3","summary":"影響: npm:next >= 16.3.0, < 16.3.8 → 16.3.8\nWith Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at…","severity":"medium","techs":["nodejs","nextjs"],"cves":["CVE-2026-103004"],"tags":["GHSA-h694-7cp9-m8p3","next"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:08:40.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}