Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences (CVE-2026-64647)
Next.js versions 13.0.0 through before 15.5.21 and 16.0.0 through before 16.2.11 have a vulnerability where server-side fetch requests with bodies containing invalid UTF-8 byte sequences can cause cached response bodies to be confused between different requests. This can lead to leakage of confidential data from one POST response to another unauthorized request. The issue occurs only when the request body charset is not UTF-8. Applications using the Pages Router are not affected.
AI Analysis
Technical Summary
This vulnerability in Next.js involves cache confusion of response bodies for server-side fetch requests that include request bodies with invalid UTF-8 byte sequences. When the request body charset differs from UTF-8, such as UTF-16 encoded bodies, the caching mechanism may return a cached response body from a different request with the same URL but a different body. This results in potential leakage of confidential data in the response body to unauthorized requests. The request itself is not deduplicated, only the response body cache is affected. The issue affects Next.js versions >=13.0.0 <15.5.21 and >=16.0.0 <16.2.11. Applications using the Pages Router are not vulnerable.
Potential Impact
Confidential data in the response body of a POST request may be leaked to unauthorized requests due to cache confusion when the request body contains invalid UTF-8 byte sequences and a non-UTF-8 charset. This can expose sensitive information to unintended parties. The vulnerability does not affect the request deduplication but only the response body caching.
Mitigation Recommendations
No official patch or fix is currently confirmed. If upgrading is not possible, mitigate by ensuring that all server-side fetch requests use UTF-8 encoded request bodies, which is the default in Next.js. Applications using the Pages Router are not vulnerable and do not require mitigation. Monitor vendor advisories for updates on official fixes.
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences (CVE-2026-64647)
Description
Next.js versions 13.0.0 through before 15.5.21 and 16.0.0 through before 16.2.11 have a vulnerability where server-side fetch requests with bodies containing invalid UTF-8 byte sequences can cause cached response bodies to be confused between different requests. This can lead to leakage of confidential data from one POST response to another unauthorized request. The issue occurs only when the request body charset is not UTF-8. Applications using the Pages Router are not affected.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Next.js involves cache confusion of response bodies for server-side fetch requests that include request bodies with invalid UTF-8 byte sequences. When the request body charset differs from UTF-8, such as UTF-16 encoded bodies, the caching mechanism may return a cached response body from a different request with the same URL but a different body. This results in potential leakage of confidential data in the response body to unauthorized requests. The request itself is not deduplicated, only the response body cache is affected. The issue affects Next.js versions >=13.0.0 <15.5.21 and >=16.0.0 <16.2.11. Applications using the Pages Router are not vulnerable.
Potential Impact
Confidential data in the response body of a POST request may be leaked to unauthorized requests due to cache confusion when the request body contains invalid UTF-8 byte sequences and a non-UTF-8 charset. This can expose sensitive information to unintended parties. The vulnerability does not affect the request deduplication but only the response body caching.
Mitigation Recommendations
No official patch or fix is currently confirmed. If upgrading is not possible, mitigate by ensuring that all server-side fetch requests use UTF-8 encoded request bodies, which is the default in Next.js. Applications using the Pages Router are not vulnerable and do not require mitigation. Monitor vendor advisories for updates on official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4633-3j49-mh5q
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64647"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a616bcd9c2644c7f80dbd91
Added to database: 07/23/2026, 01:18:05 UTC
Last enriched: 07/23/2026, 01:23:40 UTC
Last updated: 07/23/2026, 01:23:40 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.