All vulnerabilities

npm

CVE-2026-103004

next.js cache leak across root param values in nested 'use cache' functions

Severity: Medium
Published: 22 Oct 2026
Last changed: 22 Oct 2026
Added to UpHeron: 23 Oct 2026
Fixed in: 16.3.8
Also known as: GHSA-h694-7cp9-m8p3
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
Next.jsnpm · `osv:npm:next`	From 16.3.0 before 16.3.8

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-103004
GitHub Advisory Database https://github.com/advisories/GHSA-h694-7cp9-m8p3