Incident feed · ShipSecurely

Information disclosure incidents

4 incidents filed as Information disclosure, newest first.

• Information disclosureSep 30, 2026

  A nested Next.js use cache can serve one root param's content for another

  On September 30, 2026, Next.js published GHSA-h694-7cp9-m8p3. With Cache Components on, a nested use cache that reads a root param can reuse one value's content for every root param. The leaked value is not attacker-controlled. CVE-2026-103004 says 16.3.0 through 16.3.7 are affected and 16.3.8 is the patch.

  • Next.js
  • npm
• Information disclosureSep 30, 2026

  A website can read project data from the Next.js development server

  On September 30, 2026, Next.js listed a low-severity bug in next dev, CVE-2026-94486. From 16.0.0 until 16.3.8, the development server's Model Context Protocol endpoint does not reliably block cross-site requests, so a malicious site open in the developer's browser can read project data. Production does not serve the endpoint. The fix is 16.3.8.

  • Next.js
  • npm
• Information disclosureSep 30, 2026

  An overlapping Next.js request can receive Draft Mode content

  On September 30, 2026, Next.js published GHSA-3w37-wq28-93x7. Pending use cache fills do not separate Draft Mode from a normal request, so an overlapping visitor can receive unpublished content with no login. CVE-2026-94544 says next 16.3.0 before 16.3.8 is affected. The fix is 16.3.8.

  • Next.js
  • npm
• Information disclosureSep 30, 2026

  Next.js metadata image routes can ignore dynamicParams on webpack builds

  On September 30, 2026, Next.js published GHSA-f87g-xv8r-7p7x. On a webpack build, opengraph-image and twitter-image routes ignore dynamicParams, so a request can ask for a dynamic segment left out of generateStaticParams. The advisory lists next from 16.0.0. Upgrade that line to 16.3.8. Turbopack builds are not affected.

  • Next.js
  • npm