CVE-2026-64647: 
Wolfi vulnerability analysis and mitigation

CVE-2026-64647 is a cache confusion vulnerability in Next.js (App Router) where a server-side fetch with a non-UTF-8 charset request body may return a cached response body from a different request to the same URL but with a different body. This occurs because the incremental cache key generation incorrectly decodes binary body bytes as UTF-8, causing distinct byte sequences (e.g., UTF-16 encoded characters) to collide in the cache. Affected versions are >= 13.0.0, < 15.5.21 and >= 16.0.0, < 16.2.11; applications using the Pages Router are not affected. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory). The advisory was published on July 22, 2026, with the fix merged on July 21, 2026 (Next.js v15.5.21, Next.js v16.2.11).

The root cause is improper cache key generation in Next.js's incremental cache (src/server/lib/incremental-cache/index.ts), classified as CWE-116 (Improper Encoding or Escaping of Output). When computing the fetch cache key, the old code decoded binary request body bytes using a UTF-8 TextDecoder, which collapses distinct byte sequences — for example, the UTF-16 representations of \uc083\uc083 and \uc104\uc104 — into the same decoded string (U+FFFD replacement characters), producing identical cache keys for requests with different bodies. The fix (commit 025bf4a) replaces UTF-8 decoding with lossless hex encoding (toHex()) of raw body bytes, ensuring byte-exact cache keys for all binary body types (Uint8Array, ReadableStream, Blob, FormData) (GitHub Advisory, Fix Commit). The vulnerability requires that the application makes server-side fetch calls with request bodies using a non-UTF-8 charset, and that caching is enabled for those requests.

Successful exploitation allows an unauthenticated attacker to receive a cached response body intended for a different request — potentially exposing confidential data such as authentication tokens, personal information, or application secrets returned in POST response bodies. The integrity impact is low, as the attacker can observe but not directly modify data; availability is not affected. The scope is limited to the vulnerable Next.js App Router server instance, with no direct lateral movement capability, but leaked credentials or session data could enable further compromise (GitHub Advisory).

1. Identify a target endpoint: Find a Next.js App Router application (versions 13.0.0–15.5.20 or 16.0.0–16.2.10) that makes server-side fetch calls with POST bodies using a non-UTF-8 charset (e.g., UTF-16), and where the response is cached by Next.js's incremental cache.
2. Craft a colliding request body: Construct a request body whose bytes, when decoded as UTF-8, produce the same string as a known or guessable prior request body. For example, send a UTF-16 encoded body whose bytes collide with another UTF-16 body under lossy UTF-8 decoding (both map to U+FFFD replacement characters).
3. Send the crafted request: Issue a server-side fetch (or trigger the application to do so) to the same URL as the target request, using the colliding body. The Next.js incremental cache will generate the same cache key as the prior request.
4. Receive the cached response: The server returns the cached response body from the prior (different) request, potentially exposing confidential data such as user-specific API responses, tokens, or sensitive application data (GitHub Advisory, Fix Commit).

• Logs: Unexpected cache hits on server-side fetch requests with POST bodies — particularly where the same cache key is resolved for requests with visually or semantically different bodies; Next.js server logs showing cache hits for endpoints that should return user-specific data.
• Network: Repeated POST requests to the same application endpoint with varying non-UTF-8 encoded bodies (e.g., UTF-16 byte sequences) from the same or different source IPs, potentially probing for cache collisions.
• Application Behavior: Users or API consumers receiving response data that does not correspond to their request (e.g., another user's data returned in a POST response), which may surface as application errors or data integrity complaints.

Upgrade Next.js to the patched versions: 15.5.21 or 16.2.11, both released on July 21, 2026 (Next.js v15.5.21, Next.js v16.2.11). If an immediate upgrade is not possible, ensure all server-side fetch requests use UTF-8 encoded request bodies, which is the default in Next.js and avoids the cache key collision. Applications using the Pages Router are not affected and do not require patching for this issue (GitHub Advisory).

The vulnerability was part of a broader Next.js July 2026 security release that addressed multiple advisories simultaneously, including higher-severity issues such as denial-of-service and SSRF vulnerabilities. Netlify published a changelog entry acknowledging the Next.js security vulnerabilities and their platform's response (Netlify Changelog). Cloudflare's WAF team also noted the release in their changelog (Cloudflare WAF). Community reaction was generally focused on the higher-severity issues in the same release batch, with this moderate-severity finding receiving less individual attention.