{"action":"Upgrade next to 16.3.8 or later.","affected":[{"fixed":"16.3.8","introduced":"16.3.0"}],"component":"next","cve_ids":["CVE-2026-103004"],"ecosystem":"npm","exploited":false,"fixed_versions":["16.3.8"],"ghsa_id":"GHSA-h694-7cp9-m8p3","id":"tcs_01M5JMCW8GT9800BKZ51FFKPG5","modified_at":"2026-10-22T16:30:40.995176219Z","published_at":"2026-10-22T16:08:40Z","references":["https://osv.dev/vulnerability/GHSA-h694-7cp9-m8p3","https://github.com/vercel/next.js/security/advisories/GHSA-h694-7cp9-m8p3","https://nvd.nist.gov/vuln/detail/CVE-2026-103004","https://github.com/vercel/next.js/commit/e92db4536a7f34ae2dbda583cfa1b4e0d06d1865","https://github.com/vercel/next.js","https://github.com/vercel/next.js/releases/tag/v16.3.8"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-h694-7cp9-m8p3","url":"https://osv.dev/vulnerability/GHSA-h694-7cp9-m8p3"}],"summary":"next.js cache leak across root param values in nested 'use cache' functions"}