CVE-2026-103004 vercel CVE debrief

Who should care

Developers and administrators using Next.js with Cache Components enabled should assess their exposure and upgrade to the patched version as soon as possible to prevent potential content leakage. This includes reviewing cache configurations, monitoring cache behavior for unusual activity, and ensuring that the patched version is deployed in a timely manner.

Why it matters

This vulnerability in Next.js can lead to unintended cache leakage across root parameter values when using nested 'use cache' functions with Cache Components enabled. Developers and administrators should assess their exposure and take action to prevent potential content leakage.

• Verify cache configuration to prevent unintended content leakage
• Upgrade to patched version to fix the vulnerability
• Monitor cache behavior for unusual activity

Technical summary

The vulnerability occurs when using nested 'use cache' functions with Cache Components enabled in Next.js. The issue causes the enclosing function's cache key to omit the root parameter, leading to incorrect caching and potential content leakage across different root parameter values. This happens whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. The impact is that a response for one root parameter value can serve content produced for a different value.

Defensive priority

Upgrade to patched version; verify cache configuration

Recommended defensive actions

• Upgrade to version 16.3.8 or later
• Verify and adjust cache configuration
• Monitor for unusual cache behavior
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Details from the source item and CVE record indicate a cache leakage issue in Next.js when using nested 'use cache' functions with Cache Components enabled. The issue allows responses for one root parameter value to serve content produced for a different value. Grounding from source item: no specific root parameter values are mentioned but impact is noted across different values.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.