Preliminary research

Re:CACHE — Excessive reflection, type confusion, and 0-click SXSS on Next.js

Rachid Allam (zhero;) and inzo_ · zhero-web-sec · 3 June 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Combines reflected response headers with external caching in a Next.js deployment. Attacker-selected Content-Type makes an RSC response render as HTML when a cache ignores Vary, while a second cached Refresh response directs ordinary navigation to the poisoned content. The chain depends on middleware and cache behavior.

Record

Researcher

Rachid Allam (zhero;) and inzo_

Published by

zhero-web-sec

Date

3 June 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Next.js CVE-2025-57822 disclosure
• Intigriti 0825 SSRF challenge

Tags

• nextjs
• cache-poisoning
• content-type
• header-injection
• xss
• attack-chain
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Rachid Allam (zhero;) and inzo_, first published at the original source. Preserved copies are kept so the citation survives its host.