A flaw in Next.js versions 14.2.0 up to before 15.5.16 and 16.2.5 allows an attacker to poison a shared cache that stores React Server Component (RSC) payloads. When a shared cache does not correctly separate cache variants, the attacker can cause a response originally intended for an HTML consumer to be served to subsequent visitors instead, exposing component data that was not meant for that audience. The impact is potential information disclosure to unintended users as the cached payload can contain sensitive component state.

Next.js applications running on vercel:next.js with framework versions between 14.2.0 and 15.5.15 inclusive, as well as between 16.0.0 and 16.2.4 inclusive, are vulnerable. Versions 15.5.16 and later, and 16.2.5 and later have the issue addressed and are no longer affected.

The CVSS score is 5.4, indicating moderate severity. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but shared caches are common in modern web deployments, so the attack surface is non‑trivial. Based on the description, the likely attack vector is HTTP requests targeting the RSC endpoints in a shared caching environment where the response is not correctly isolated. An attacker could thus manipulate the cache entry, causing subsequent legitimate users to receive incorrect component payloads.