Next.js vulnerable to cache poisoning in React Server Component responses
Affected releases · next
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.2.0 – 14.2.35No fix on this line yet
On 16.x, the newest line:
npm install next@16.2.5Affected
16.0.0 – 16.2.4
25 releases
Fixed
16.2.5 – 16.4.2
20 releases, latest
Affected
15.0.0 – 15.5.15
70 releases
Fixed
15.5.16 – 15.5.28
12 releases
Not affected
14.0.0 – 14.1.4
10 releases
Affected
14.2.0 – 14.2.35
36 releases
Is your project affected?
Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.
What happens
Impact
Applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML.
Fix
We now validate and interpret RSC request headers consistently across request classification and rendering, and we enforce the intended cache-busting behavior so RSC payloads are not unexpectedly served from the original URL.
Workarounds
If you cannot upgrade immediately, ensure your CDN or reverse proxy keys on the relevant RSC request headers and honors Vary, or disable shared caching for affected App Router and RSC responses.