Next.js incorrectly handles cache keys for server‑side fetches when the request body’s content type uses a charset other than UTF‑8. The application may return a cached response body from a different POST request to the same URL, allowing confidential data written in a prior correct request to be exposed to an unauthorized request. The weakness involves incorrect encoding conversion (CWE‑116) and encoding mismatch leading to persistent cache key collisions (CWE‑524).

The affected product is Vercel’s Next.js framework. Affected releases include all versions from 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10. Versions 15.5.21 and 16.2.11 have the issue resolved.

The CVSS score of 6.3 indicates a medium severity vulnerability. The EPSS score of < 1% shows a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector involves submitting a POST request with a non‑UTF‑8 encoded body to a URL that performs server‑side fetching; the attacker can trigger a cached response from a previous legitimate request and retrieve sensitive data. The exploit does not require authentication, but the attacker must control the HTTP request. Given the limited exploitation data, the threat remains moderate but could pose significant risk if an attacker can generate appropriate requests.