Next.js's server-side fetch implementation uses URL-only cache keys, which creates a collision vulnerability when POST requests carry non-UTF-8 encoded bodies. Two different request bodies—sequences like 삃삃 and 섄섄 that produce distinct UTF-16 bytes—can hash to the same cache entry, causing the server to return the wrong cached response to one of the requests. This is not a configuration error on your part; it's a logic gap in how Next.js normalizes request bodies before computing the cache key, and it only manifests with non-UTF-8 charsets, which is why most applications never encounter it.
The critical asymmetry to understand: Next.js still deduplicates requests correctly—the actual serverless function executes per-request as expected—but the response body returned comes from the wrong cache entry. The deduping layer and the caching layer are operating on different key material, and that's where the leak occurs.
If you're using non-UTF-8 character encodings in POST bodies, this affects you directly. The fix is in Next.js 15.5.21 and 16.2.11. For most applications using UTF-8, this specific vector doesn't apply, but the underlying design choice—URL-only cache keys ignoring body content—is worth noting. It's the same pattern that has produced cache poisoning vulnerabilities across other frameworks when they abstract away HTTP semantics for developer ergonomics. The abstraction makes fetch-from-server feel like fetch-from-client, but the caching semantics don't translate, and this is one of those gaps that only surfaces with unusual input.
Audit any code path where POST requests with non-UTF-8 bodies pass through Next.js fetch, and verify your deployed version is patched. If you're on an affected line, prioritize the update—the collision trigger is narrow, but the consequence (response mixing between distinct requests) is a genuine data integrity failure.