Next.js versions from 16.3.0 to 16.3.7 have a vulnerability in their 'use cache' handlers when Cache Components are enabled (cacheComponents: true). A 'use cache' function that calls another 'use cache' function reading a root param can produce cache keys that omit that root param. Consequently, the enclosing cache entry is shared across different root param values, causing responses for one root param to serve content intended for another. This affects pages prerendered at build time, runtime, or rendered dynamically. Shared cache headers can further propagate this content leakage downstream. The leaked values are not attacker-controlled; the served content depends on the first cache entry written. The vulnerability is patched in version 16.3.8.

The vulnerability allows sensitive information cached for one root parameter value to be served to requests with different root parameter values. This can cause unintended data leakage between pages, potentially exposing sensitive data to unauthorized viewers. However, the leaked values are not attacker-controlled, limiting exploitation scope. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low complexity, partial attack complexity, and low impact on confidentiality.

Upgrade Next.js to version 16.3.8 or later, where this caching issue has been fixed. No other mitigation is required as the vendor has provided an official fix.