Repository navigation
fix(deps): update dependency next to v16.3.8 [security] - #9
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
16.3.3→16.3.8next.js cache leak across root param values in nested 'use cache' functions
CVE-2026-103004 / GHSA-h694-7cp9-m8p3
More information
Details
Impact
With Cache Components enabled (
cacheComponents: true), a'use cache'function that calls another'use cache'function that reads a root param can be keyed incorrectly when the inner call is served from an existing entry: the enclosing function's cache key then omits that root param. The enclosing entry is written once and reused for all root param values, so a response for one root param value can serve content produced for a different value — whether the page is prerendered at build time or at runtime, or rendered dynamically. Shared cache headers let downstream caches redistribute the content further.What values are leaked cannot be attacker controlled. Which value's content is served depends only on which invocation wrote the entry first.
Workarounds
There are no known workarounds. Apps should upgrade to the patched version as soon as possible.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vercel/next.js (next)
v16.3.8Compare Source
This release contains security fixes for the following advisories:
High:
Medium:
use cachefill can leak Draft Mode content into regular responses and persisted pagesLow:
v16.3.7Compare Source
Core Changes
Credits
Huge thanks to @lukesandberg for helping!
v16.3.6Compare Source
This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse
v16.3.5Compare Source
The following bug fixes have been backported. It does not include all pending features/changes on canary.
output: 'standalone'is used with an adapter (#98167)use cacheprerender signal retention (#98448)v16.3.4Compare Source
Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).
The following bug fixes have been backported. It does not include all pending features/changes on canary.
Credits
Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.