Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first. This has been patched in 16.3.8.

The version of Next.js installed on the remote host is 15.0.0 prior to 15.5.27 or 16.0.0 prior to 16.3.8. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery vulnerability in the Image Optimization API, where an attacker-controlled, allow-listed remote URL can lead to requests to private IP addresses. This issue only affects versions 16.0.0 and later. (CVE-2026-94483)

- A cache poisoning vulnerability in self-hosted applications using the Pages Router with SSG or ISR pages, allowing a page's cache entry to be replaced with content from a different route. (CVE-2026-94543)

- A cache poisoning vulnerability in applications using a root-level catch-all page together with SSG or ISR routes, leading to cross-user content substitution and persistent denial of service. (CVE-2026-94484)

- An information disclosure vulnerability in App Router metadata image routes built with webpack, which ignore the 'dynamicParams' route segment option. (CVE-2026-94485)

- An information disclosure vulnerability where pending 'use cache' fills are shared between Draft Mode and regular requests, leaking unpublished content. This issue only affects versions 16.0.0 and later. (CVE-2026-94544)

- A cache leak across root param values in nested 'use cache' functions when Cache Components are enabled. This issue only affects versions 16.0.0 and later. (CVE-2026-103004)

- An information disclosure vulnerability in the development server's Model Context Protocol endpoint, which does not verify the request origin. This issue only affects versions 16.0.0 and later. (CVE-2026-94486)

Note that the scanner has not attempted to exploit these issues but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak
    their return value to pages with different root params. With Cache Components enabled (cacheComponents:
    true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed
    incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then
    omits that root param. The enclosing entry is written once and reused for all root param values, so a
    response for one root param value can serve content produced for a different value — whether the page is
    prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream
    caches redistribute the content further. What values are leaked cannot be attacker controlled. Which
    value's content is served depends only on which invocation wrote the entry first. This has been patched in
    16.3.8. (CVE-2026-103004)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak     their return value to pages with different root params. With Cache Components enabled (cacheComponents:
    true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed     incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then     omits that root param. The enclosing entry is written once and reused for all root param values, so a     response for one root param value can serve content produced for a different value  whether the page is     prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream     caches redistribute the content further. What values are leaked cannot be attacker controlled. Which     value's content is served depends only on which invocation wrote the entry first. This has been patched in     16.3.8. (CVE-2026-103004)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115752	Next.js 16.0.x < 16.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115751	Next.js 15.x < 15.5.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
476832	SCA: security update for next (GHSA-h694-7cp9-m8p3)	Tenable Cloud Security	SCA Checks	Local	medium
476832	SCA: security update for next (GHSA-h694-7cp9-m8p3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
362435	Linux Distros Unpatched Vulnerability : CVE-2026-103004	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-103004

medium

Tenable Plugins

high

high

medium

medium

medium