This vulnerability occurs in Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10 where a server‑side fetch request that includes a body can return a cached response body from a different request to the same URL but with a different body. The result can be the exposure of confidential data contained in the POST response to unauthorized users. The weakness stems from improper handling of cache keys when the fetch init differs from the Request init, classified as CWE‑524.

Vulnerable systems are applications built with the Vercel Next.js framework, specifically the affected product versions listed above. Any deployment using Next.js 12 – 15.5.20 or 16 – 16.2.10 and performing server‑side fetches with bodies is at risk until the code is upgraded to at least 15.5.21 or 16.2.11.

The CVSS score of 6.0 indicates moderate severity. The EPSS score is < 1%, indicating a low exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is a remote attacker sending crafted POST requests to a vulnerable page that performs a server‑side fetch. The exploit would require that the attacker can observe the side‑channel of the cached response body, which would reveal sensitive data. Once the vulnerability is exploited, confidentiality is compromised; integrity and availability are not directly affected.