CVE-2026-64647: 
Wolfi vulnerability analysis and mitigation

CVE-2026-64647 is a cache confusion vulnerability in Next.js (App Router) where server-side fetch operations with non-UTF-8 charset request bodies generate incorrect cache keys, potentially returning cached response bodies intended for different requests. Discovered by researcher "yorukot" and published on July 22, 2026, it affects Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10. The vulnerability carries a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 6.3 (Medium) (GitHub Advisory, Feedly). Applications using the Pages Router are not affected.

The root cause lies in Next.js's incremental cache key generation logic (CWE-116: Improper Encoding or Escaping of Output; CWE-524: Use of Cache Containing Sensitive Information). When computing the fetch cache key, the original code decoded binary request bodies using a UTF-8 TextDecoder, which collapses distinct byte sequences — such as different UTF-16 encoded strings — into the same decoded string, producing identical cache keys for requests with different bodies to the same URL. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 would decode to the same UTF-8 representation, causing a cache collision. The fix (PR #96008) replaces the lossy UTF-8 decoding with byte-exact hex encoding (toHex()) of request bodies, ensuring each unique binary body produces a unique cache key (GitHub Advisory, Fix Commit).

A successful exploit allows an unauthenticated attacker to receive cached response bodies originally generated for a different user's POST request to the same URL, resulting in confidential data disclosure. The impact is primarily a confidentiality breach — sensitive data such as user-specific API responses, session data, or personal information could be leaked to unauthorized parties. Integrity is also marginally affected, as an attacker could receive and act upon data intended for another user. Availability is not impacted, and there is no direct path to code execution or lateral movement from this vulnerability alone (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.51%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific conditions: the target application must use Next.js App Router with server-side fetch caching enabled, and the attacker must be able to send requests with non-UTF-8 charset bodies (e.g., UTF-16) to the same endpoint as a legitimate user.

1. Reconnaissance: Identify a Next.js application (versions 13.0.0–15.5.20 or 16.0.0–16.2.10) using the App Router with server-side fetch caching enabled. Confirm the application is not using the Pages Router, which is not vulnerable.
2. Identify target endpoint: Find an API endpoint or server action that performs a server-side fetch() with a POST body and caches the response (i.e., the fetch is not opted out of caching).
3. Craft non-UTF-8 body: Construct a request body using a non-UTF-8 charset (e.g., UTF-16) whose byte sequence, when decoded as UTF-8, collides with the byte sequence of a legitimate user's request body to the same URL. For example, craft a UTF-16 encoded body that maps to the same decoded string as a target user's request.
4. Send the crafted request: Submit the POST request with the crafted non-UTF-8 body to the target endpoint. If the cache has been populated by a prior legitimate request with a colliding body, the server returns the cached response from that prior request.
5. Retrieve leaked data: Parse the response body, which may contain confidential data (e.g., user-specific API data, session information) from the prior legitimate request (GitHub Advisory, Fix Commit).

• Network: Unusual POST requests to Next.js App Router endpoints with Content-Type headers specifying non-UTF-8 charsets (e.g., charset=UTF-16, charset=ISO-8859-1) from unexpected or anonymous clients.
• Logs: Next.js server logs showing repeated POST requests to the same URL with varying body content but identical cache key hits; responses served from cache for requests that should have produced unique results.
• Application Behavior: Users reporting receiving data belonging to other users in API responses; unexpected cache hits for POST requests that should not be cached together.

Upgrade Next.js to version 15.5.21 (for the 15.x branch) or 16.2.11 (for the 16.x branch), both released on July 21, 2026, which contain the byte-exact cache key fix (v15.5.21 Release, v16.2.11 Release). If immediate patching is not possible, restrict server-side fetch requests to UTF-8 encoded bodies only (the default in Next.js), or disable fetch caching for endpoints handling sensitive data. Applications using the Pages Router exclusively are not affected and do not require immediate action (GitHub Advisory).

The vulnerability was disclosed as part of a broader Next.js July 2026 security release that addressed nine security flaws, including higher-severity SSRF and DoS issues, which drew significant coverage from security news outlets (CyberSecurityNews, GBHackers). Netlify and Cloudflare both published changelog entries acknowledging the Next.js security vulnerabilities and their platform-level responses (Netlify). The Next.js team published an official security release blog post detailing all nine advisories (Next.js Blog). Community reaction was largely focused on the higher-severity issues in the same release batch, with CVE-2026-64647 receiving moderate attention given its Medium severity rating.