This vulnerability in Next.js involves cache confusion for server-side fetch calls that include request bodies. When a fetch call is made with a request body, the server may incorrectly return a cached response body from a previous request to the same URL but with a different request body, leading to potential leakage of confidential data in the response. The problem specifically occurs if the fetch call uses a different init object than the one used to create the Request object. The vulnerability affects Next.js versions >=13.0.0 <15.5.21 and >=16.0.0 <16.2.11. Applications using the Pages Router are not vulnerable. No workaround exists except upgrading to a fixed version.

Confidential data in the response body of POST requests may be leaked to unauthorized requests due to cache confusion. This can expose sensitive information from one user's request to another user making a different request to the same URL. The request itself is not deduplicated, but the response body cache confusion causes the data leak. This impacts server-side fetch calls with request bodies in affected Next.js versions.

Upgrade Next.js to a version later than 15.5.20 for the 13.x branch or later than 16.2.10 for the 16.x branch to resolve this vulnerability. No other workaround is available. Applications using the Pages Router are not vulnerable and do not require action.