---
id: GHSA-673q-mjm6-r5xr
title: >-
  Next.js: Unauthenticated Remote Code Execution in `use cache` functions
  returning typed arrays
summary: >-
  Next.js: Unauthenticated Remote Code Execution in `use cache` functions
  returning typed arrays
severity: critical
cwe:
  - CWE-502
vendor: next
product: next
ecosystem: npm
affected:
  - 'next >= 16.0.0, <= 16.4.0'
patched:
  - next 16.4.1
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T16:42:32Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-673q-mjm6-r5xr'
references:
  - url: 'https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr'
  - url: >-
      https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f
  - url: 'https://github.com/vercel/next.js/releases/tag/v16.4.1'
  - url: 'https://github.com/advisories/GHSA-673q-mjm6-r5xr'
tags:
  - ghsa
  - npm
ingestedAt: '2026-10-22T22:00:50.252Z'
---

## Overview

## Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.

## Workaround

There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.

## Affected packages

- `next >= 16.0.0, <= 16.4.0`

## Remediation

Upgrade to a patched release:

- `next 16.4.1`