GHSA-673q-mjm6-r5xrCritical▾ MidnightNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.
There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
next >= 16.0.0, <= 16.4.0Upgrade to a patched release:
next 16.4.1Connected by shared product, vendor, weakness, or advisory.
GHSA-2464-fhr4-w9xwCriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse
GHSA-2xp9-vwfh-vxw4CriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
CVE-2026-75604Critical· 9.0Next.js is a React framework for building full-stack web applications
CVE-2026-64643MediumNext.js: Unauthenticated disclosure of internal Server Function endpoints