---
id: CVE-2026-64648
title: >-
  next: Next.js: Information disclosure via server-side fetch cache
  (CVE-2026-64648)
summary: >-
  A flaw was found in Next.js. A remote attacker could exploit a vulnerability
  in the server-side fetch mechanism, where a request with a body might receive
  a cached response intended for a different request to the same URL but
  different bod…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe: CWE-524
vendor: Red Hat
product: Red Hat Enterprise Linux AI (RHEL AI) 3
affected:
  - enterprise_linux_ai_rhel_ai 3
  - streams_for_apache_kafka 2
  - streams_for_apache_kafka 3.2.1
patched:
  - streams_for_apache_kafka 3.2.1
published: '2026-07-27'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T19:30:35+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64648.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64648.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64648'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507642'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64648'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64648'
  - url: >-
      https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c
  - url: >-
      https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a
  - url: 'https://github.com/vercel/next.js/releases/tag/v15.5.21'
  - url: 'https://github.com/vercel/next.js/releases/tag/v16.2.11'
  - url: 'https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742'
  - url: 'https://access.redhat.com/errata/RHSA-2026:54435'
  - url: 'https://github.com/advisories/GHSA-68g3-v927-f742'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00338
epssPercentile: 0.27055
aliases:
  - GHSA-68g3-v927-f742
ecosystem: npm
ingestedAt: '2026-07-23T00:08:38.922Z'
---

## Overview

A flaw was found in Next.js. A remote attacker could exploit a vulnerability in the server-side fetch mechanism, where a request with a body might receive a cached response intended for a different request to the same URL but different body. This could lead to the unauthorized disclosure of confidential data from POST request response bodies to an unprivileged user.

## Vendor advisories

- **RHSA-2026:54435** · Red Hat · fixed in: Streams for Apache Kafka 3.2.1 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54435)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux AI (RHEL AI) 3, streams for Apache Kafka 2 · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, streams for Apache Kafka 2 · updated 2026-10-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64648.json)

**next: Next.js: Information disclosure via server-side fetch cache** — rated Important by Red Hat. Released 2026-07-27, updated 2026-10-06.

Affected:

- Red Hat Enterprise Linux AI (RHEL AI) 3
- streams for Apache Kafka 2

Fixed:

- Streams for Apache Kafka 3.2.1

No fix planned:

- Red Hat Enterprise Linux AI (RHEL AI) 3
- streams for Apache Kafka 2

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Trusted Artifact Signer

## Remediation

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54435

## Package advisory (CVE-2026-64648)

Affected packages:

- `next >= 13.0.0, < 15.5.21`
- `next >= 16.0.0, < 16.2.11`

Patched in:

- `next 15.5.21`
- `next 16.2.11`

Source: https://github.com/advisories/GHSA-68g3-v927-f742