<!-- https://linear.app/vercel/issue/NSEC-747 --> Self-hosted Next.js applications served with `next start` and built with `cacheComponents: true` but without Partial Prefetching accept a request-supplied route param value as a prerender placeholder. One unauthenticated GET request can poison the fallback shell cache entry that a family of routes shares. Such a route is served from a shell that keeps its never-prerenderable params as placeholders, so every value of those params shares one cache entry. A path segment equal to the percent-encoded, bracketed name of its own route param is treated as an unresolved placeholder, and only that param is deferred. A layout above it then renders its concrete value into the shell during the blocking render, and the result, including its HTTP status, is stored under the shared key. Depending on the application, the stored entry is one of the following: - A persistent 404, when the layout rejects the value with `notFound()`: served to every URL under the shell key with `"revalidate": false`, across server restarts, with no error logged. - A substituted param value, when the layout renders the value: the server-rendered HTML renders the attacker's value for that param in place of the visitor's own. A JavaScript client corrects it on hydration. No markup or script injection is possible, and no data is disclosed. ### Preconditions 1. `cacheComponents: true` with `partialPrefetching` unset or `false`. 2. Self-hosted serving with `next start`. 3. A dynamic route with a prerenderable param (`generateStaticParams`) whose requested value was not generated at build time. 4. At least two never-prerenderable params below it: a layout reading the shallower one inside a Suspense boundary, and a deeper one the request supplies as the placeholder. 5. A blocking fallback shell. ### Workarounds Set `partialPrefetching: true` in `next.config`. Otherwise, apps should upgrade to the patched version as soon as possible.