This release contains security fixes for the following advisories:
Moderate
- Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
- Cache leak across root param values in nested 'use cache' functions (follow-up)
- Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
- Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
- Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
- SVG rejection bypass in Next.js image optimization
- HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes