GHSA-673q-mjm6-r5xr
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
- Risk score
- 67/100
- CVSS
- 9.5 v4.0
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A critical vulnerability in Next.js allows unauthenticated remote code execution in applications using App router with Cache Component. An attacker could exploit this vulnerability to execute code remotely.
- Affected
- {'products': ['Next.js'], 'packages': [{'ecosystem': 'npm', 'name': 'next', 'vulnerable': '>= 16.0.0, <= 16.4.0'}]}
- Fix
- Upgrade to version 16.4.1 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.5 critical
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| next | npm | >= 16.0.0, <= 16.4.0 | 16.4.1 |
References
- https://github.com/advisories/GHSA-673q-mjm6-r5xr
- https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
- https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f
- https://github.com/vercel/next.js/releases/tag/v16.4.1
- https://github.com/advisories/GHSA-673q-mjm6-r5xr
Original description
## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. ## Workaround There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.
Last activity 22 Oct 2026. Patch Forecast updates every hour.