onyx

onyx --cves cve-2026-103004

CVE-2026-103004

MEDNext.js
score
0.4
cvss
5.3
epss
0.2%
published
2026-10-01
kev added
—
first seen

Next.js 16.3.0 to 16.3.7 contains a cache keying issue caused by incorrect handling of root params in 'use cache' functions, letting attackers leak cached content across different root params, exploit requires Cache Components enabled.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-10-01 — PublishedP2026-10-21 (seen by) — Tracked by OnyxTscore2026-10-21: score 0.40.4epss2026-10-02: epss 0.3%2026-10-03: epss 0.3%2026-10-04: epss 0.3%2026-10-05: epss 0.3%2026-10-06: epss 0.3%2026-10-07: epss 0.3%2026-10-08: epss 0.3%2026-10-09: epss 0.3%2026-10-10: epss 0.3%2026-10-11: epss 0.3%2026-10-12: epss 0.3%2026-10-13: epss 0.3%2026-10-14: epss 0.3%2026-10-15: epss 0.3%2026-10-16: epss 0.3%2026-10-18: epss 0.3%2026-10-19: epss 0.3%2026-10-20: epss 0.3%2026-10-21: epss 0.3%0.3%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx

Weaknesses

CWE-524

References 2