Updates are now available in v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS) to address these issues. Please patch your Next.js dependencies to maintain the security of your applications.
The cached function must read a root parameter, such as a tenant identifier. During a cold cache fill, a concurrent call through unstable_cache can receive another request's result without checking its root parameters.
That result can then be stored and served to later callers with the same arguments until the entry is revalidated or evicted. Where root parameters separate tenants, the result can contain another tenant's data. This affects applications where an inner cached function reads a root parameter and returns an early value alongside a slower asynchronous value, while the outer function finishes without waiting for the slower value.
