All vulnerabilities
GHSA-673q-mjm6-r5xr

next: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

nextnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
9.5Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in16.4.1Fixed versionGitHub
Published22 Oct 2026Updated 22 Oct 2026GitHub

What fixes it

  • 16.4.1next, npmGitHubnpm install next@16.4.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Text from GitHub Advisory Database

Affected versions 3

  • next, npm>= 16.0.0, <= 16.4.0GitHub
  • next, npm>=16.0.0 <= 16.4.0GitHub
  • next, npmfrom 16.0.0, fixed in 16.4.1OSV

References 4