Vulnerability in Vercel Next.js

CVE-2026-64648

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to th…

Affected products

  • Vercel Next.js — versions >= 13.0.0, < 15.5.21, >= 16.0.0, < 16.2.11

Weakness classification (CWE)

References