{"id":"GHSA-673q-mjm6-r5xr","title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","summary":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","severity":"critical","cwe":["CWE-502"],"vendor":"next","product":"next","ecosystem":"npm","affected":["next >= 16.0.0, <= 16.4.0"],"patched":["next 16.4.1"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T16:42:32Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-673q-mjm6-r5xr","references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr"},{"url":"https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f"},{"url":"https://github.com/vercel/next.js/releases/tag/v16.4.1"},{"url":"https://github.com/advisories/GHSA-673q-mjm6-r5xr"}],"tags":["ghsa","npm"],"ingestedAt":"2026-10-22T22:00:50.252Z","slug":"GHSA-673q-mjm6-r5xr","body":"## Overview\n\n## Impact\n\nA vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\n## Workaround\n\nThere is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.\n\n## Affected packages\n\n- `next >= 16.0.0, <= 16.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `next 16.4.1`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}