What is CVE-2026-64648?
CVE-2026-64648 is a critical vulnerability in the Next.js framework affecting versions 12.0.0-15.5.20 and 16.0.0-16.2.10. A server-side fetch with a request body may incorrectly return a cached response body from a different request to the same URL but with a different body. This leads to potential leakage of confidential data in POST requests; immediate version upgrade is recommended.
Azərbaycanca: CVE-2026-64648 Next.js framework-də kritik bir boşluqdur. 12.0.0-15.5.20 və 16.0.0-16.2.10 versiyalarına təsir edir: server-side fetch əməliyyatı zamanı eyni URL-ə fərqli body ilə edilən sorğular, səhvən əvvəlki sorğunun cache-lənmiş cavabını qaytara bilər. Bu, POST sorğularında konfidensial məlumatların sızmasına səbəb olur; versiyanı dərhal yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-200
FAQ2
What threat does CVE-2026-64648 pose in Next.js?
This vulnerability causes server-side fetch operations to incorrectly return a cached response body from a previous request to the same URL with a different body. This can lead to the leakage of confidential data in POST requests.
How can I protect against CVE-2026-64648?
If you are using the affected versions 12.0.0-15.5.20 or 16.0.0-16.2.10, you should immediately upgrade your Next.js version.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.