Skepra / Web recovery & resilience
On 3 November 2026, the Next.js maintainers published a moderate advisory about HttpOnly cookie exposure through an internal response header on certain Edge runtime routes.
Ask whether this applies to your siteThe advisory says that applications which set cookies through NextResponse on Edge runtime routes can include the internal x-middleware-set-cookie header in the public response. That duplicates the cookie value and attributes, which can make an HttpOnly cookie readable by JavaScript running on the same origin.
The maintainer limits this to App Router route handlers and Pages Router Edge API routes that run in the Edge runtime and set cookies through NextResponse. Confirm the deployed version, runtime and affected route behaviour before planning a change.
The published advisory lists Next.js versions 15.0.0 through 15.5.28 and 16.0.0 through 16.4.2 as affected. At the time of the advisory, the maintainer listed no patched versions.
Ask the application owner or maintainer to confirm the deployed Next.js version, whether the affected route type runs in the Edge runtime, and whether that route sets sensitive cookies through NextResponse. Do not copy cookies, session tokens, credentials or response data into the public contact route.
If those conditions are confirmed, agree the owner, scope and maintenance route before changing the application. Verify the maintainer advisory again immediately before implementation, because fix availability and guidance can change.
Next.js GitHub Security Advisory GHSA-f3mh-rxg3-f5g2, 3 Nov 2026.
