Next.js Patch Fixes Cross-Tenant Data Leak in use cache

Next.js 16.4.5 and 15.5.29 fix seven vulnerabilities, including a High-severity bug that can serve one tenant’s cached data to another, according to the Next.js November 2026 security release, published Nov. 3. Apps that use Cache Components with a root parameter such as a tenant ID should upgrade first.

The Cache Bugs

The High-severity bug (GHSA-mfr8-8qww-v76h) hits apps that call the same public use cache function both directly and inside unstable_cache. During a cold cache fill, the unstable_cache call can receive another request’s result without a root-parameter check. That result is then stored and served to later callers until it is revalidated or evicted. Where root parameters separate tenants, the leaked data is another tenant’s.

Two Medium bugs sit in the same area. Nested use cache functions can serve content built for one root-parameter value to requests for another (GHSA-vc7v-qv4w-wrv8). Distinct binary arguments, such as a Blob, can produce the same cache identity, so one user can receive another user’s cached result (GHSA-rhh4-g77r-r9qj). The Next.js team said neither gives access to unrelated cache entries.

The Rest

• Edge cookies (GHSA-f3mh-rxg3-f5g2): Edge Route Handlers that set cookies with NextResponse.cookies.set() expose the value in the x-middleware-set-cookie header, which same-origin JavaScript can read even for HttpOnly cookies. Next.js said it needs attacker-controlled script on the same origin.
• Image Optimization (GHSA-7qx7-33qx-rqx2): a crafted image can bypass images.dangerouslyAllowSVG: false.
• Self-hosted only: shared page shells can be poisoned by a crafted URL under next start, and a compressed-response framing mismatch (GHSA-pc58-hwjq-p385) can cross responses between clients behind some HTTP/1.1 proxies.

What Netlify Said

Netlify said in its Nov. 3 changelog that three cache bugs (nested use cache, shell poisoning and binary arguments) and the Edge cookie issue affect apps hosted there. The image bypass and the unstable_cache leak do not. It said each request runs in an isolated invocation, and its image CDN handles optimization. It also rated all seven Medium, one notch below Next.js’s own High.

Upgrading next alone does not close the Middleware cookie case on Netlify. Netlify said to update @netlify/plugin-nextjs to 5.16.6 if you pin it. A new deploy clears cached content only for its own deploy context, so purge branch deploys and Deploy Previews separately. Entries that opted out of automatic invalidation with the Netlify-Cache-ID header stay cached until purged. Netlify also said public previews may stay vulnerable until they are deleted.

Firerun’s Take

This follows the Sept. 30 security release and the Oct. 14 out-of-band update. Most of this one is about caching: a use cache entry is only as safe as the arguments that key it. If a Blob or a root parameter is the only thing separating two users, treat it as a security boundary and check it after upgrading.

Netlify’s “not affected” calls are the host’s assessment, not a patch. Upgrade, redeploy, then purge.

Key Takeaways

• Run npm install next@16.4.5 (or next@15.5.29 on 15.x) and redeploy.
• Cache Components apps keyed on tenant or user need the upgrade most.
• On Netlify, update the adapter if pinned, purge old deploy contexts and delete public previews.