Member-only story

NextjsWeb SecurityReactWeb DevelopmentProgramming Your Next.js Cache Can Serve One User’s Private Data to Another

Coders Stop

6 min read11 hours ago

Press enter or click to view image in full size

On the first cold start after a deploy, Next.js could hand one request the data it had just finished fetching for a different request. If your root parameter is a tenant ID, that is customer A reading customer B’s dashboard, served from cache, with a 200 and no error anywhere in your logs.

That is the short version of CVE-2026–119790 , patched on November 3 in Next.js 16.4.5. It only bites a specific code shape, and that shape is easy to write by accident during a migration. So the useful question is not “is Next.js broken,” it is “did I write the shape.” Here is exactly what it looks like and how to check in about ten minutes.

The three ingredients the leak needs

This is not a generic “caching is hard” story.…