Next.js, a widely used React framework, can expose its React Server Component responses to cache poisoning when the internal _rsc cache‑busting value is not properly partitioned. This flaw is categorized as CWE‑328 and CWE‑354, reflecting insecure cache key management and input validation weaknesses that allow a malicious entity to insert a false response into a shared cache. An attacker can craft a request that collides with an existing cache entry, causing a shared cache to store a malicious or altered response. Subsequent users accessing that URL would receive the wrong server‑generated content, potentially misleading or compromising them.

The vulnerability targets the Vercel distributions of Next.js. All releases from 13.4.6 up to but excluding 15.5.16 and 16.2.5 are affected. Versions newer than 15.5.16 or 16.2.5 contain the fix for this flaw.

The CVSS score is 3.7, indicating low severity. The EPSS score of 0.009% suggests a very low exploitation probability. The issue is not listed in the CISA KEV catalog. This weakness corresponds to CWE‑328 and CWE‑354, indicating insecure cache key management and input validation can be exploited. Based on the description, an unauthenticated attacker can trigger a collision by sending requests that include a manipulated _rsc token against a deployment that utilizes a shared cache without proper response partitioning. When these conditions are met, the attacker can poison the cache so that end users receive incorrect server‑generated content.