Search results

PPR: cached shell is keyed without search params but stores the filling request's query — anonymous cross-request leakage of other users' URLs

MiddlewareRelated to Next.js Middleware.Related to Next.js Middleware.

Status: Open.

#96385 In vercel/next.js;

· hypernomad opened on Jul 30, 2026

[next-rspack] A proxy.ts/middleware.ts entry makes the server compile 10-20x slower (persistent cache); scales with dependency count

Status: Open.

#96377 In vercel/next.js;

· Dwlad90 opened on Jul 30, 2026

BOM marker causes Next.js dev and build to fail

CSSRelated to CSS.Related to CSS.

Status: Open.

Bug

#96374 In vercel/next.js;

· terrymun opened on Jul 30, 2026

Route group layout leaks into root not-found page

Not FoundRelated to the not-found.tsx file or the notFound() function.Related to the not-found.tsx file or the notFound() function.

Status: Open.

Bug

#96361 In vercel/next.js;

· lsvs opened on Jul 29, 2026

Forwarded Server Actions expose the internal origin (localhost:PORT) via headers() — breaks host-based multi-tenancy when self-hosting

Status: Open.

#96344 In vercel/next.js;

· squaredd opened on Jul 29, 2026

"use cache" fill aborted by renderSignal during a runtime prefetch is stored as a valid entry — truncated Flight prelude permanently breaks all readers ("Error: Connection closed.")

Status: Open.

#96339 In vercel/next.js;

· hypernomad opened on Jul 29, 2026

Turbopack + optimizePackageImports tree-shakes a sideEffects-allowlisted, side-effect-only module (breaks react-focus-lock)

TurbopackRelated to Turbopack with Next.js.Related to Turbopack with Next.js.

Status: Open.

Bug

#96333 In vercel/next.js;

· sentience opened on Jul 29, 2026

Server Action passed as an argument fails when called after navigation

Server ActionsRelated to Server Actions.Related to Server Actions.

Status: Open.

Bug

#96331 In vercel/next.js;

· hi-ogawa opened on Jul 29, 2026

Telemetry _controller is always undefined due to Promise identity loss in record(), so flushDetached's abort is a silent no-op

RuntimeRelated to Node.js or Edge Runtime with Next.js.Related to Node.js or Edge Runtime with Next.js.

Status: Open.

Bug

#96317 In vercel/next.js;

· ash2228 opened on Jul 28, 2026

next build can wait far beyond the built-in telemetry timeout when a caller signal is provided

PerformanceAnything with regards to Next.js performance.Anything with regards to Next.js performance.

RuntimeRelated to Node.js or Edge Runtime with Next.js.Related to Node.js or Edge Runtime with Next.js.

Status: Open.

Bug

#96291 In vercel/next.js;

· cyhforlight opened on Jul 28, 2026

PPR resume replay fails for optional catch-all routes after revalidateTag on Vercel, degraded response (no metadata, empty body) is CDN-cached.

Dynamic RoutesRelated to dynamic routes.Related to dynamic routes.

MetadataRelated to Next.js' Metadata API.Related to Next.js' Metadata API.

Status: Open.

#96289 In vercel/next.js;

· jamesirving opened on Jul 28, 2026

Middleware Set-Cookie on prerendered static pages produces cacheable responses with s-maxage=31536000 - CDN caches and serves auth tokens to other users

CookiesRelated to the async cookies() function.Related to the async cookies() function.

MiddlewareRelated to Next.js Middleware.Related to Next.js Middleware.

Status: Open.

#96266 In vercel/next.js;

· uiYzzi opened on Jul 27, 2026