next.js cache leak across root param values in nested 'use cache' functions

影響: npm:next >= 16.3.0, < 16.3.8 → 16.3.8

With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at…

GitHub Advisory Databaseで読む

2026/10/23 01:08、GitHub Advisory Databaseが「next.js cache leak across root param values in nested 'use cache' functions」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js、Next.js。CVE: CVE-2026-103004。