CVE-2026-64647
1 advisory.
npm/next CVE-2026-64647: medium
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
Action: Upgrade next to 15.5.21 or later.
npm i next@15.5.21npm i next@16.2.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 13.0.0 | 15.5.21 | - |
| 16.0.0 | 16.2.11 | - |
Fixed versions
| 15.5.21 | 16.2.11 |
Sources
- osv: GHSA-4633-3j49-mh5q
- https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q
- https://github.com/vercel/next.js/pull/96008
- https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v15.5.21
- https://github.com/vercel/next.js/releases/tag/v16.2.11
CVE-2026-64647 · published · modified · JSON