AIKIDO-2026-10191

TL;DR

Affected versions of this package are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is exposed on all routes and can be manipulated by attackers to alter caching behavior, allowing user-specific or sensitive responses to be cached and subsequently served to other users. Successful exploitation requires an authenticated victim to visit an attacker-controlled link.