Threats Tagged 'ghsa-4jqv-mc3x-m676'

Next.js versions from 15.0.0 up to but not including 15.5.27, and from 16.0.0 up to but not including 16.3.8, contain a vulnerability where the response cache for statically generated or Incremental Static Regeneration pages using the Pages Router can be incorrectly keyed. This allows a request to replace one page's cached content with that of another route, causing incorrect content to be served to visitors until the cache is revalidated. Applications deployed on Vercel are not affected. The issue is fixed in versions 15.5.27 and 16.3.8.