Next.js 16.4.5 and 15.5.29: Fix Cross‑Tenant Cache Disclosure

When unstable_cache Calls Race a Cold use cache Fill #

The High-severity advisory GHSA-mfr8-8qww-v76h needs three conditions: Cache Components enabled, a public use cache function that reads a root parameter such as a tenant identifier, and that same function called both directly and from inside unstable_cache. The Next.js security release describes the failure during a cold cache fill, when a concurrent call can get another request's result. That result is stored and served to later callers with the same arguments until the entry is revalidated or evicted.

"During a cold cache fill, a concurrent call through unstable_cache can receive another request's result without checking its root parameters." (Next.js security release)

Where root parameters separate tenants, the stored result can contain another tenant's data. This suggests that the described path requires both call sites on the same function, so a codebase that uses only one of them is outside the scenario this advisory describes. Searching for both patterns, as shown in the check section below, is the quickest way to find candidates.

Nested use cache Functions and Binary Arguments Reuse Entries Across Callers #

Medium severity applies to two related Cache Components advisories. GHSA-vc7v-qv4w-wrv8 affects nested public use cache functions where the inner function reads a root parameter and returns an early value alongside a slower asynchronous value. The outer function finishes without waiting for the slower value, so the outer entry can be stored before the inner function's root-parameter dependencies are recorded. The result can serve tenant-, site-, or locale-specific content across the matching routing boundary. The attacker does not inject content; the application generates the content that is reused.

GHSA-rhh4-g77r-r9qj is a separate cache-identity problem: distinct binary arguments passed to a use cache function can produce the same cache identity. If the application uses those arguments to tell users or accounts apart, and the other identity inputs match, one caller can receive another user's cached result, or cause its own result to be served to another user. The advisory states that it does not permit arbitrary access to unrelated cache entries.

Self-Hosted Deployments Running next start and Reverse Proxies #

Medium severity applies to two self-hosted advisories. The shared shell issue affects applications running next start with Cache Components enabled and Partial Prefetching disabled or unset. An unauthenticated request with a crafted URL can store request-specific values in a shell used by other URLs, producing incorrect server-rendered content or persistent 404 responses. The route shape involves a prerenderable dynamic parameter requested with a value not generated at build time, at least two deeper parameters that are never prerendered, and a blocking fallback shell, with a layout reading the shallower deeper parameter inside a Suspense boundary. Configurations with Partial Prefetching enabled were not affected in the reported tests.

GHSA-pc58-hwjq-p385 applies to self-hosted applications that return an attacker-controlled fetched Response unchanged. Such an application can forward decompressed body bytes with the original compressed response's framing headers. Behind an HTTP/1.1 reverse proxy that queues pipelined requests on a shared backend connection, responses can be assigned to the wrong clients, so an attacker who can arrange requests on that connection may inject or receive a response. The advisory says this requires the described proxy behavior and does not apply to every reverse-proxy configuration.

Cookie Values Exposed Through x-middleware-set-cookie on Edge Routes #

GHSA-f3mh-rxg3-f5g2 is rated Medium. App Router Edge Route Handlers and Pages Router Edge API routes that set cookies with NextResponse.cookies.set() can expose the serialized cookie in the internal x-middleware-set-cookie response header. Unlike Set-Cookie, this header can be read by same-origin JavaScript, which exposes cookie values even when they are marked HttpOnly. Impact needs a sensitive cookie set on an affected response and attacker-controlled JavaScript on the same origin, and the advisory states it is not an independent way to execute JavaScript. The reproduced leak did not affect Node.js Route Handlers or routes that set cookies through cookies().set().

SVG Reaching the Image Optimization Parser Despite dangerouslyAllowSVG: false #

GHSA-7qx7-33qx-rqx2 is rated Medium. An attacker-controlled image from a permitted source can be misclassified as AVIF and bypass images.dangerouslyAllowSVG: false, so the image optimization backend identifies and decodes the original bytes as SVG. The image-source allowlist still applies. The issue requires a native image backend capable of decoding SVG. It increases exposure to SVG parser resource exhaustion or decoder vulnerabilities, but the advisory states it does not itself demonstrate cross-site scripting or remote code execution.

The lead source states no affected version range, gives no CVE identifiers or CVSS scores, and lists the shared shell issue without a GHSA identifier.

Upgrade steps #

1. Install the patched release for your line. The lead source lists these commands:

   BashCopy

   npm install next@16.4.5   # 16.x line (Active LTS)
   npm install next@15.5.29  # 15.5 line (Maintenance LTS)

   The source's inline comment on the 16.4.5 command reads "for 16.5", while the command itself installs 16.4.5.

2. For self-hosted apps running next start with Cache Components, review the Partial Prefetching setting. The shell issue applies when it is disabled or unset; reported tests found configurations with it enabled were not affected.

3. For self-hosted apps behind a reverse proxy, check whether the proxy speaks HTTP/1.1 and queues pipelined requests on a shared backend connection, and whether the app returns fetched Response objects unchanged.

4. Review Edge Route Handlers and Edge API routes that set sensitive cookies with NextResponse.cookies.set(). Node.js Route Handlers and cookies().set() were not reproduced as affected.

5. If image optimization runs on a native backend that can decode SVG, the bypass of images.dangerouslyAllowSVG: false applies to it.

How to Check a Next.js Project for These Patterns #

Start with the dependency and the start script in package.json, which show the Next.js version and whether the app is served with next start.

grep -nE "\"next\"|next start" package.json

Then search the code for the functions and settings named in the advisories. A match on unstable_cache or use cache points to the Cache Components advisories, a match on NextResponse.cookies.set to the Edge cookie advisory, and a match on dangerouslyAllowSVG to the image advisory.

grep -rnE "unstable_cache|use cache|NextResponse\.cookies\.set|dangerouslyAllowSVG" .