onyx

onyx --cves cve-2026-64648

CVE-2026-64648

MEDNext.js
score
0.1
cvss
5.4
epss
0.3%
published
2026-07-27
kev added
—
first seen

Next.js 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10 contain an information disclosure vulnerability caused by server-side fetch caching response bodies incorrectly, letting attackers receive cached confidential data from different requests, exploit requires unsafe fetch usage with differing init parameters.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2026-07-27 — PublishedP2026-10-21 (seen by) — Tracked by OnyxTscore2026-10-21: score 0.10.1epss2026-09-22: epss 0.3%2026-09-23: epss 0.3%2026-09-24: epss 0.3%2026-09-25: epss 0.3%2026-09-26: epss 0.3%2026-09-27: epss 0.3%2026-09-29: epss 0.3%2026-09-30: epss 0.3%2026-10-01: epss 0.3%2026-10-02: epss 0.3%2026-10-03: epss 0.3%2026-10-04: epss 0.3%2026-10-05: epss 0.3%2026-10-06: epss 0.3%2026-10-07: epss 0.3%2026-10-08: epss 0.3%2026-10-09: epss 0.3%2026-10-10: epss 0.3%2026-10-11: epss 0.3%2026-10-12: epss 0.3%2026-10-13: epss 0.3%2026-10-14: epss 0.3%2026-10-15: epss 0.3%2026-10-16: epss 0.3%2026-10-18: epss 0.3%2026-10-19: epss 0.3%2026-10-20: epss 0.3%2026-10-21: epss 0.3%0.3%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx

Weaknesses

CWE-524

References 5