The flaw is in Next.js 16.3.x where warm use cache handlers that access root parameters can be keyed incorrectly when nested cache calls read root params. The outer cache entry is written once and reused for all root param values, causing a response generated for one root param value to be served under a different root param. This leads to unintended data disclosure between pages that share the same cache entry. The weakness is a form of insecure caching (CWE‑524), and the affected content may be part of any page rendered at build time, runtime, or dynamically. While an attacker cannot control which value is leaked, the fact that content generated for an arbitrary root parameter can be served to another visitor satisfies an information‑disclosure condition.

Affected versions are Vercel’s Next.js 16.3.0 through 16.3.7. The vulnerability is triggered when Cache Components is enabled (cacheComponents: true). Versions up to 16.3.7 are vulnerable; the issue was fixed in v16.3.8.

The CVSS score of 6.3 indicates a medium severity, and the EPSS score is not available, so the exploitation probability is unknown but the issue is not listed in CISA’s KEV catalog. The attack requires a normal request to a page that uses a warm use cache handler; the inner call reads a root param and the outer handler is incorrectly cached. Because the root param value that ends up being served depends on which execution created the cache entry first, the attacker cannot direct the disclosure, but the flaw can still leak content from other root param values. Thus, the vulnerability is mainly a data‑leak scenario that may affect multiple users once a cache entry has been created.