Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further. What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first. This has been patched in 16.3.8.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak
    their return value to pages with different root params. With Cache Components enabled (cacheComponents:
    true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed
    incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then
    omits that root param. The enclosing entry is written once and reused for all root param values, so a
    response for one root param value can serve content produced for a different value — whether the page is
    prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream
    caches redistribute the content further. What values are leaked cannot be attacker controlled. Which
    value's content is served depends only on which invocation wrote the entry first. This has been patched in
    16.3.8. (CVE-2026-103004)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak     their return value to pages with different root params. With Cache Components enabled (cacheComponents:
    true), a 'use cache' function that calls another 'use cache' function that reads a root param can be keyed     incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then     omits that root param. The enclosing entry is written once and reused for all root param values, so a     response for one root param value can serve content produced for a different value  whether the page is     prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream     caches redistribute the content further. What values are leaked cannot be attacker controlled. Which     value's content is served depends only on which invocation wrote the entry first. This has been patched in     16.3.8. (CVE-2026-103004)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476832	SCA: security update for next (GHSA-h694-7cp9-m8p3)	Tenable Cloud Security	SCA Checks	Local	medium
476832	SCA: security update for next (GHSA-h694-7cp9-m8p3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
362435	Linux Distros Unpatched Vulnerability : CVE-2026-103004	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-103004

medium

Tenable Plugins

medium

medium

medium