A nested Next.js use cache can serve one root param's content for another

GHSA-h694-7cp9-m8p3, published September 30, 2026, says that with Cache Components enabled, a use cache function that calls another use cache function that reads a root param can be keyed incorrectly when the inner call is already cached. The outer function's cache key then omits that root param. The entry is written once and reused for every root param value, including prerendered and dynamic pages. Shared cache headers can send that content further. The advisory says the leaked value cannot be chosen by an attacker. Which value is served depends on which invocation wrote the entry first. It lists next 16.3.0, patched in 16.3.8, and says there is no workaround.

CVE-2026-103004, published October 1, 2026, says Next.js versions from 16.3.0 to 16.3.7 can leak a warm use cache handler's return value across root params, and that 16.3.8 is the patch. The record's affected range is also written as every version before 16.3.8. This note follows the description's 16.3.0 to 16.3.7 range, which matches the GHSA's 16.3.0 line.