https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:10:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-380617 EUVD-2026-380617 https://cve.radiocsirt.org/vuln/euvd-2026-380617 https://cve.radiocsirt.org/vuln/fkie_cve-2026-103004 <p>Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a &#39;use cache&#39; function that calls another &#39;use cache&#39; function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function&#39;s cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further.</p> <p>What values are leaked cannot be attacker controlled. Which value&#39;s content is served depends only on which invocation wrote the entry first.</p> <p>This has been patched in 16.3.8.</p> <p>Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a &#39;use cache&#39; function that calls another &#39;use cache&#39; function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function&#39;s cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further.</p> <p>What values are leaked cannot be attacker controlled. Which value&#39;s content is served depends only on which invocation wrote the entry first.</p> <p>This has been patched in 16.3.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-103004