AI & Agent Dev Bug Sandbox Back to Radar

On-Demand ISR Revalidation Reports Success But Serves Stale Content When A Background Render Is In-Flight

In Next.js Pages Router, calling res.revalidate('/') after a content publish can return success while the next request still serves the pre-publish version. This occurs when a normal background ISR render is already in-flight and reads data before publication; the on-demand revalidation reuses that in-flight render, and the stale result is persisted with a fresh cache timestamp.

highConfidence 87%Next.js Affected V16.3.6 Affected V16.4.0-Canary.48 Affected V16.4.0-Canary.50

Origin Analysis

ResponseCache separates normal and on-demand requests in its get batcher, but the later revalidateBatcher keys only on the route key. An on-demand revalidation can therefore join an existing normal render that read data before publication, and that older result is then stored as if it were fresh. Regression follows #80853.

1. Create a Pages Router page with getStaticProps that reads a version and adds a 3-second render delay.\n2. Build and start the app.\n3. Request the page to get a STALE response and trigger a background render reading version N.\n4. After 0.75 seconds, publish version N+1 and call res.revalidate('/').\n5. Wait 1 second and request the page again.\n6. Observe that x-nextjs-cache is HIT and the served version is still N, while the API reported revalidated:true.

Fixing Code Block

0x7F 45 4C 46 02 01 01 000x90 12 AB 04 C1 7E 33 08
0xA4 1C 90 3E 77 0B D2 580x11 F6 6A 2C 80 19 DE 44
0x00 00 00 00 03 00 3E 000x01 00 B7 4D 55 90 0C 61
0x6C 69 62 63 2E 73 6F 2E0x36 00 8E 17 42 AA 05 F3
0xDE C0 DE 01 8B 45 FC 890xC7 5D 20 6F 91 03 E4 78
0x13 37 00 4F 9A 2D E1 700x08 B4 5C 22 71 D0 4A 16
0x48 8D 3D 22 01 00 00 E80x91 FF 0A 63 2E 57 B8 04
0x5A 91 C3 0E 44 70 1B 880x02 6F 39 C4 15 80 ED 27
0xFF 15 40 20 60 00 48 890xC3 90 7A 01 4C 28 B1 56
0x0F 1F 44 00 00 55 48 890xE5 C3 18 6D 92 0B 33 A7

Edge Case Audit

The in-memory token map is process-local; in multi-instance or serverless deployments sharing a cache handler, a stale render from another instance may still overwrite after an on-demand revalidation on a different instance. Tokens also accumulate indefinitely without cleanup; add a TTL or remove entries after cache set completes. Rollback: revert to next@15.5.10 or disable on-demand revalidation until an official fix is available. Test with existing normal ISR intervals to ensure no cache poisoning.