High [CVE-2026-64648] Information disclosure via server-side fetch cache

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body.

Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.

This only applies to fetch calls with a request that has a different init than the one passed to fetch. An unsafe request would be: fetch(new Request(init), aDifferentInit).

This issue has been fixed in versions 15.5.21 and 16.2.11. A flaw was found in Next.js.

The vulnerability is triggered by specific unsafe fetch patterns where the request object's initialization differs from the fetch call's initialization. Red Hat customers using Next.js applications should review their fetch implementations, noting that applications built with Pages Router are not impacted.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-524.

Affected Red Hat products: Streams for Apache Kafka 3.2.1; Red Hat Enterprise Linux AI (RHEL AI) 3; streams for Apache Kafka 2. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Trusted Artifact Signer as not affected.