GHSA-68g3-v927-f742 Next.js: Cache confusion of response bodies for requests with bodies

• npm next: >= 13.0.0, < 15.5.21 → fixed in 15.5.21 • npm next: >= 16.0.0, < 16.2.11 → fixed in 16.2.11

Impact A server-side `fetch` with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the `POST`'s response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`. Safe: `fetch(new Request(init), init)` Unsafe: `fetch(new Request(init), aDifferentInit)` Workarounds No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.