next.js cache leak across root param values in nested 'use cache' functions

影響: npm:next >= 16.3.0, < 16.3.8 → 16.3.8

With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at…

Read on GitHub Advisory Database

On 10/23/2026, 01:08 AM, GitHub Advisory Database published "next.js cache leak across root param values in nested 'use cache' functions" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js, Next.js. CVE: CVE-2026-103004.