## next.js cache leak across root param values in nested 'use cache' functions

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs, nextjs
- CVE: CVE-2026-103004
- 公開日時: 2026-10-22T16:08:40.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-h694-7cp9-m8p3)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-h694-7cp9-m8p3

影響: npm:next >= 16.3.0, < 16.3.8 → 16.3.8
With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at…