GHSA-673q-mjm6-r5xr

Summary

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

Severity

critical

CWE

CWE-502

Published

2026-10-22

Updated

2026-10-22

Advisory details

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

References

• https://github.com/advisories/GHSA-673q-mjm6-r5xr
• https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
• https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f
• https://github.com/vercel/next.js/releases/tag/v16.4.1

Related advisories

• GHSA-2464-fhr4-w9xw — critical · npm/next
• GHSA-vcvr-r3jv-pc5j — critical · npm/next
• GHSA-2xp9-vwfh-vxw4 — critical · npm/next
• CVE-2026-75604 — critical · npm/next
• CVE-2026-94482 — high · npm/next
• CVE-2026-94483 — high · npm/next
• CVE-2026-64649 — high · npm/next
• CVE-2026-64645 — high · npm/next

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity