Skip to content

Next.js patches seven bugs, including a HttpOnly cookie leak

Next.js 16.4.5 and 15.5.29 fix seven moderate-severity issues, the sharpest of which lets client-side JavaScript read HttpOnly session cookies on Edge runtime routes.

Source: GitHub Security Advisories (vercel/next.js)

Vercel shipped its pre-announced November security release for Next.js on 3 November, patching seven moderate-severity vulnerabilities across versions 16.0.0 to 16.4.2 and 15.0.0 to 15.5.28. All seven were published as separate GitHub advisories the same day, credited to eps1lon.

The one worth reading closely is GHSA-f3mh-rxg3-f5g2. On Edge runtime route handlers, Next.js sets cookies through an internal x-middleware-set-cookie header that duplicates the cookie value into the public response. That header makes HttpOnly cookies, including session tokens, readable by client-side JavaScript on the same origin. The rest cover cache poisoning and information disclosure in use cache and unstable_cache(), a cache-poisoning route in Cache Components, an SVG rejection bypass in image optimisation, and response injection in self-hosted deployments that forward fetched responses.

Why it matters: if you set cookies on Edge runtime routes, upgrade to 16.4.5 or 15.5.29 now rather than on your usual patch cycle. A cookie marked HttpOnly is meant to be unreachable from JavaScript precisely to blunt XSS, and this bug quietly removed that protection for anyone on an affected version.

The caveat: every one of the seven is rated Moderate, not Critical, and Vercel has not said any are being exploited. The urgency here is the cookie bug’s specific mechanism, not the overall severity.

Share

Related reading

Engineering

How to patch PHP in a hurry without breaking production

PHP ships an out-of-band fix for two critical flaws at 14:00 UTC today. Here is the hour of preparation that turns the patch into a non-event, and the runbook for when it lands.

ML for Web Devs

Machine learning for web developers: the only mental model you need

You do not need calculus to work with models. You need one idea, that a model is a function you fit instead of write, and the rest follows from things you already know.

Web

View transitions without a framework

Animating between two states used to mean keeping both in the DOM and choreographing them by hand. The browser will now do the hard part for you, in about six lines.

More from The Wire

All briefs