GHSA-673q-mjm6-r5xr in the critical feed json
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
published 2026-10-14 25 d ago modified 2026-10-22 17 d ago
- cvss
- 9.5
- version 4.0, the maintainers
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
## Impact
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.
## Workaround
There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.
Patch / fix
- npm next 16.4.1
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| the maintainers | 4.0 | 9.5 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | next | >=16.0.0, <16.4.1 |
16.4.1 |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
- Technology feeds
References
Sources
- GitHub Advisory GHSA-673q-mjm6-r5xr
- Maintainer advisory GHSA-673q-mjm6-r5xr
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of vercel/next.js published their own advisory on GitHub. Reviewed sources take precedence over it.