UpHeron
All vulnerabilities

npm

CVE-2026-64647

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Severity
Medium
Published
22 Jul 2026
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
15.5.21, 16.2.11
Also known as
GHSA-4633-3j49-mh5q
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
Next.jsnpm · osv:npm:next
  • From 13.0.0 before 15.5.21
  • From 16.0.0 before 16.2.11

References