next.js cache leak across root param values in nested 'use cache' functions

影響: npm:next >= 16.3.0, < 16.3.8 → 16.3.8

With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at…

在 GitHub Advisory Database 阅读

2026/10/23 01:08，GitHub Advisory Database 发布了“next.js cache leak across root param values in nested 'use cache' functions”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js、Next.js。CVE：CVE-2026-103004。