Live › vulnerability › GHSA-673q-mjm6-r5xr
Go to dashboardNext.js versions 16.0.0 through 16.4.0 contain a deserialization flaw (CWE-502) in App router apps that use a 'use cache' function returning multiple typed arrays. An unauthenticated remote attacker can execute code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| next | npm | >= 16.0.0, <= 16.4.0 | 16.4.1 |
Run npm ls next and check whether the installed version is between 16.0.0 and 16.4.0 inclusive. Search the app for 'use cache' functions that return typed arrays.
16.4.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.
There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
This page as .md · .json · in your agent: get_signal("GHSA-673q-mjm6-r5xr")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.