MicrosoftAnalysisNext.js patches cross-tenant cache disclosure flaw in Cache Components
What happened.Vercel and the Next.js team published a high-severity advisory detailing a cross-tenant cache disclosure vulnerability in Cache Components.
Why it matters.Web applications rely on caching to reduce database overhead across SaaS dashboards. When caching primitives fail to validate tenancy partition keys during concurrent cold fills, private records bleed across organizational boundaries. Engineering teams operating multi-tenant Next.js services should update to version 16.4.5 or 15.5.29 immediately. Platform engineers must audit caching layers to ensure tenant identifiers remain strictly isolated within partition keys.
The technical specifications:
- Vulnerability mechanics: Tracked as GHSA-mfr8-8qww-v76h, the flaw occurs when a cached function reading a root parameter is called directly and from inside `unstable_cache`.
- Race condition impact: During a cold cache fill, concurrent invocations through `unstable_cache` capture another request output without checking root parameters.
- Data leakage risk: On multi-tenant applications where root parameters partition customer boundaries, cached responses serve private data to unrelated callers.
- Remediation release: The maintainers published patched packages across maintenance lines, advising teams to upgrade dependencies to Next.js 16.4.5 or 15.5.29 immediately.