CVE-2026-64648: 
Wolfi vulnerability analysis and mitigation

CVE-2026-64648 is a cache confusion vulnerability in Next.js (App Router) that causes server-side fetch calls with a request body to return a cached response body from a different request to the same URL but with a different body. This can result in confidential data from a POST response leaking to unauthorized requests. The vulnerability affects Next.js versions >= 13.0.0 and < 15.5.21, and >= 16.0.0 and < 16.2.11; applications using the Pages Router are not affected. It was published on July 21, 2026, and carries a CVSS v4.0 base score of 6.0 (Medium) (Github Advisory).

The root cause is classified as CWE-524 (Use of Cache Containing Sensitive Information). Next.js's patched fetch implementation in packages/next/src/server/lib/patch-fetch.ts failed to correctly merge the Request object and the separate init parameter when both were passed to fetch(new Request(init), aDifferentInit). Because the cache key was derived from the base Request rather than the effective merged request, two calls to the same URL with different bodies could collide on the same cache entry, causing a prior response body to be served to a subsequent, different request. The fix merges the init overrides into the Request object before cache key computation, ensuring the cache key reflects the actual outgoing request (Github Advisory, Next.js commit 062f667, Next.js commit 73b9487).

Successful exploitation allows any user — authenticated or unauthenticated — who can trigger server-side fetch calls to receive cached response bodies containing confidential data from a previous, unrelated request to the same URL. This primarily impacts confidentiality (rated High in CVSS v4), with a minor integrity impact (Low) and no availability impact. Sensitive data such as authentication tokens, personal information, or business-critical API responses included in POST response bodies could be disclosed to unauthorized parties (Github Advisory).

1. Identify target: Locate a Next.js App Router application (versions >= 13.0.0 < 15.5.21 or >= 16.0.0 < 16.2.11) that performs server-side fetch calls using the pattern fetch(new Request(url, initA), initB) where initA and initB differ (e.g., different request bodies).
2. Trigger a legitimate cached request: Cause the server to execute a fetch(new Request(url, initA), initB) call that results in a sensitive response (e.g., a POST to an API endpoint returning user-specific data). This populates the fetch cache with the response body keyed by the base Request URL.
3. Send a different request to the same URL: Trigger another server-side fetch to the same URL but with a different init (e.g., different body or headers). Because the cache key is based on the base Request rather than the effective merged request, the previously cached response body is returned.
4. Receive leaked data: The attacker's request receives the cached response body from the prior request, potentially exposing confidential data such as authentication tokens, user records, or API secrets (Github Advisory).

Upgrade to Next.js version 15.5.21 (for the 13.x–15.x branch) or 16.2.11 (for the 16.x branch), which contain the fix that merges Request and init parameters before cache key computation (Next.js v15.5.21 release, Next.js v16.2.11 release). No configuration-based workaround exists; upgrading is the only remediation. As an interim code-level mitigation, developers can ensure fetch calls use the safe pattern fetch(new Request(init), init) (same init passed to both) rather than fetch(new Request(init), aDifferentInit). Applications using the Pages Router are not affected and do not require action (Github Advisory).

The vulnerability was part of a broader Next.js July 2026 security release that addressed multiple advisories, including higher-severity issues such as Denial of Service and SSRF vulnerabilities, which may have drawn more community attention than this moderate-severity finding (Next.js v15.5.21 release). Netlify published a changelog entry acknowledging the Next.js security vulnerabilities and their platform's response. Cloudflare's WAF changelog also referenced the release, indicating broad ecosystem awareness among hosting providers.