GitHub Advisoryadvisory · npm

GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

CRITICAL Published 2026-10-22 Modified 2026-10-22 Official page ↗
Ecosystem
npm
Packages
next
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
Weaknesses
CWE-502
Reviewed
2026-10-22

Affected packages

• npm next: >= 16.0.0, < 16.4.1 → fixed in 16.4.1

Description

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References