Next.js patches seven bugs, the worst a cross-tenant cache leak
The security release Vercel pre-announced last week lands in 16.4.5 and 15.5.29, fixing a High-severity cache disclosure plus six Medium-severity issues.
Vercel shipped its pre-announced November security release on 3 November, patching seven vulnerabilities in Next.js 16.4.5 (Active LTS) and 15.5.29 (Maintenance LTS).
The worst is High severity: apps with Cache Components enabled can disclose cached content across tenants when the same 'use cache' function is called both directly and from inside unstable_cache. During a cold cache fill, a concurrent call through unstable_cache can store another request’s result without checking its root parameters, so one tenant’s response gets served to another until the entry revalidates. The other six, all Medium severity, include a related cross-root-parameter leak in nested use cache calls, cache-identity collisions from binary arguments, shared-shell poisoning on self-hosted next start, a HttpOnly cookie leak through the internal x-middleware-set-cookie header, and an SVG rejection bypass in Image Optimization. Vercel assigned GHSA advisory IDs rather than CVEs for most of them.
npm install next@16.4.5 # for 16.x
npm install next@15.5.29 # for 15.xWhy it matters: anyone using Cache Components, especially in multi-tenant apps, should treat the cache-disclosure pair as urgent and upgrade now rather than waiting for the next routine bump.
The caveat: Vercel doesn’t say whether any of these were exploited, or give numbered version ranges, only the configurations affected.