Next.js 16.4.5, 15.5.29 and 16.4.6: Cross‑Tenant Cache Fix

Cache Components on Next.js 16: Four Advisories Without a 15.x Range #

Four advisories concern Cache Components and the 'use cache' directive, and none of them lists a 15.x version as affected. Their ranges start at different 16.x releases and all end at 16.4.4, so the fix for every one of them is 16.4.5. A 15.5 application is outside all four whatever features it uses; a 16.x application with Cache Components should read each condition below, because the four reach different code paths.

GHSA-mfr8-8qww-v76h (CVE-2026-119790, CVSS 4.0 6.3, from 16.3.0 up to and including 16.4.4) needs one 'use cache' function that reads a root param and is called both directly during rendering and through unstable_cache(). During the first fill after a process start, an unstable_cache() call can join the in-flight fill of a concurrent direct call and store its result under a key without root params. Requests for other root param values, such as another tenant or locale, then receive that entry until it is revalidated or evicted.

"Outside this race, the nesting already throws an error: 'use cache' inside unstable_cache() is unsupported, and avoiding it is a complete workaround." (GHSA-mfr8-8qww-v76h)

GHSA-vc7v-qv4w-wrv8 (CVE-2026-119351, 6.3, from 16.2.0 up to and including 16.4.4) affects nested 'use cache' functions. When the inner function reads a root param through next/root-params and returns a value that still holds pending promises, the outer function can finish first, and its entry is stored under a key that omits that root param. The advisory calls it a variant of GHSA-h694-7cp9-m8p3 that the fix for that earlier advisory does not cover, so an application patched for the earlier one still needs 16.4.5.

GHSA-rhh4-g77r-r9qj (CVE-2026-119349, 6.3, from 16.0.0 up to and including 16.4.4) is about binary arguments: distinct Uint8Array or Blob values passed to a 'use cache' function can produce identical cache keys. If those arguments distinguish users or accounts, one user can receive another user's cached result or have their own result served to someone else. The security post adds that it does not permit arbitrary access to unrelated cache entries.

GHSA-vvgp-ww4w-46vf (CVE-2026-119350, 6.3, from 16.4.0 up to and including 16.4.4) is the shared fallback shell issue, which the security post lists without an advisory ID. It needs cacheComponents: true with partialPrefetching unset or false, serving with next start, and a route shape with a prerenderable param requested with a value not generated at build time and two never-prerenderable params below it. One unauthenticated GET request can then store a persistent 404 or a substituted param value in the shell that a family of routes shares.

Self-Hosted Next.js and Edge Routes: Three Advisories on 15.x and 16.x #

The other three advisories reach both lines, and 15.5.29 is the fixed release on 15.x. GHSA-pc58-hwjq-p385 (CVE-2026-119348, 6.3) affects self-hosted applications whose route handlers or fetch cache return a fetched upstream response unchanged. The response can carry the framing headers of the original compressed response with decompressed bytes, and behind an HTTP/1.1 reverse proxy that queues pipelined requests on a shared backend connection, responses can reach the wrong clients. The security post stresses that it needs that proxy behavior and does not apply to every reverse-proxy configuration.

GHSA-f3mh-rxg3-f5g2 (CVE-2026-119346, 6.0) affects Edge runtime routes, App Router route handlers and Pages Router Edge API routes, that set cookies through NextResponse. They send an internal x-middleware-set-cookie header that duplicates the cookie, so HttpOnly cookies such as session tokens become readable by same-origin JavaScript. Impact needs a sensitive cookie on an affected response and attacker-controlled JavaScript on the same origin; the reproduced leak did not affect Node.js route handlers or cookies().set().

GHSA-7qx7-33qx-rqx2 (CVE-2026-119347, 6.9) lets the image optimizer at /_next/image on self-hosted deployments process an attacker-supplied SVG although dangerouslyAllowSVG: false, the default, should exclude it. The image is misclassified as AVIF and then decoded as SVG by a native backend that can decode SVG; the image-source allowlist still applies. The result is exposure to SVG parser resource exhaustion and decoder flaws, not demonstrated cross-site scripting or code execution.

Upgrading to Next.js 16.4.5, 16.4.6 or 15.5.29 #

The severity labels disagree between sources: the security post rates GHSA-mfr8-8qww-v76h High, while its advisory rates it medium and the 16.4.5 release notes list all seven under Moderate. Whatever label a team goes by, the ranges decide who must act. Next.js 16.4.6, released on November 9, is a later backport release on the 16.4 line whose notes list no security fix, so 16.4.5 or 16.4.6 both sit outside every 16.x range.

1. On 16.x, install next@16.4.5 or the later next@16.4.6; on 15.5, install next@15.5.29. The security post's own command for 16.4.5 carries the comment "for 16.5", but it installs 16.4.5.
2. If a self-hosted 16.4 application with cacheComponents: true cannot upgrade at once, set partialPrefetching: true in next.config, the workaround GHSA-vvgp-ww4w-46vf gives.
3. If a 'use cache' function is called inside unstable_cache(), remove that nesting: the advisory names avoiding it a complete workaround for GHSA-mfr8-8qww-v76h.
4. After moving to 16.4.6, expect route handler responses to be compressed automatically when they are not compressed already, one of its backports alongside a Tailwind 4.3.3 pin in create-next-app and Turbopack garbage collection fixes for development.

npm install next@16.4.6   # 16.x line: 16.4.5 or later
npm install next@15.5.29  # 15.5 line

Checking a Next.js Project for the Affected Version and Features #

The installed version decides most of this: npm ls next prints the resolved next package, and anything from 16.0.0 up to and including 16.4.4 or up to and including 15.5.28 is inside at least one range. The features then decide which advisories apply. A search for the directive, the cache function, the root params import and the settings named above points to the four 16.x advisories; the cookie call points to the Edge advisory, and dangerouslyAllowSVG to the image advisory.

npm ls next
grep -rnE "use cache|unstable_cache|next/root-params|cacheComponents|partialPrefetching|NextResponse\.cookies\.set|dangerouslyAllowSVG" --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" --include="*.mjs" .