Next.js handles caching for functions that use the experimental cache API. During versions 16.3.0 to 16.3.8, a pending cache fill for a given key is shared between requests that are in Draft Mode and regular requests. If a draft‑mode request writes data to the cache, an overlapping regular request can read that unpublished data, and vice versa. The result is that unauthenticated users may receive content that is intended only for editors, violating confidentiality and potentially exposing intellectual property or unreleased features. The weakness is an improper design that allows data leakage via shared cache state (CWE‑524).

Vercel’s Next.js framework, versions 16.3.0 through 16.3.8, is affected when Cache Components or experimental.useCache is enabled and cached functions return draft‑dependent content. Sites built with these settings are vulnerable if a draft editor’s content can be cached under the same key that a regular visitor accesses.

The CVSS score of 6.3 indicates a medium severity vulnerability. EPSS information is not available, so the precise likelihood of exploitation cannot be quantified, and the issue is not listed in CISA's KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector requires an attacker to trigger simultaneous or overlapping requests to the same cache key, one in Draft Mode and one as a normal request, possibly by sending crafted URLs or by abusing concurrent browsing actions. Successful exploitation can lead to undisclosed draft content being served to unauthenticated users or persistent storage of draft data in pre‑rendered pages until they are revalidated.