{"id":"GHSA-673q-mjm6-r5xr","kind":"vulnerability","aliases":["GHSA-673q-mjm6-r5xr"],"related":[],"title":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","description":"## Impact\n\nA vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\n## Workaround\n\nThere is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.","summary":"Next.js versions 16.0.0 through 16.4.0 contain a deserialization flaw (CWE-502) in App router apps that use a 'use cache' function returning multiple typed arrays. An unauthenticated remote attacker can execute code on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"next","fixed":["16.4.1"],"affected":">= 16.0.0, <= 16.4.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["app-router","cwe-502","next.js","package","self-hosted"],"not_affected_if":["version-16.4.1-or-later","version-below-16.0.0"],"how_to_check":"Run `npm ls next` and check whether the installed version is between 16.0.0 and 16.4.0 inclusive. Search the app for 'use cache' functions that return typed arrays.","fix":"Upgrade next to 16.4.1 or later. No workaround is documented, so upgrade even if no such function is found.","status":"open","published_at":"2026-10-22T16:42:31+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:06:37+00:00","updated_at":"2026-10-23T20:06:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:06:37Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade next to 16.4.1 or later. No workaround is documented, so upgrade even if no such function is found.","summary":"Next.js versions 16.0.0 through 16.4.0 contain a deserialization flaw (CWE-502) in App router apps that use a 'use cache' function returning multiple typed arrays. An unauthenticated remote attacker can execute code on the server.","category":"package","who_cares":["next.js","self-hosted","app-router"],"confidence":0.8,"analyst_note":"","how_to_check":"Run `npm ls next` and check whether the installed version is between 16.0.0 and 16.4.0 inclusive. Search the app for 'use cache' functions that return typed arrays.","needs_analyst":false,"not_affected_if":["version-below-16.0.0","version-16.4.1-or-later"],"severity_if_unknown":"critical"},"cost_usd":0.000358,"input_tokens":2067,"output_tokens":303,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-502':28B,44B '16.0.0':36B '16.4.0':38B '673q':15A,20A 'affect':107C 'app':25B,46B,48B,75C 'app-rout':24B 'applic':73C,87C,108C,121C 'array':12A,58B,99C 'attack':62B 'cach':8A,53B,78C,93C,112C 'code':4A,65B,84C 'compon':79C 'contain':39B 'cwe':27B,43B 'deseri':41B 'even':118C 'execut':5A,64B,85C 'flaw':42B 'function':9A,54B,94C,113C,126C 'ghsa':14A,19A 'ghsa-673q-mjm6-r5xr':13A,18A 'host':33B 'immedi':117C 'impact':69C 'known':104C 'lead':81C 'mjm6':16A,21A 'multipl':56B,97C 'need':88C 'next':23A 'next.js':1A,29B,34B 'packag':30B 'r5xr':17A,22A 'remot':3A,61B,83C 'return':10A,55B,96C 'router':26B,47B,76C 'self':32B 'self-host':31B 'server':68B 'similar':125C 'type':11A,57B,98C 'unauthent':2A,60B 'upgrad':116C 'use':7A,50B,52B,74C,92C,111C 'version':35B 'vulner':71C 'workaround':100C,105C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T16:42:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-673q-mjm6-r5xr","url":"https://github.com/advisories/GHSA-673q-mjm6-r5xr","severity":"critical","published_at":"2026-10-22T16:42:31+00:00","modified_at":"2026-10-22T16:42:32+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}