Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

GHSA-673q-mjm6-r5xr

Published Oct 22, 2026 · Modified Oct 22, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

References

WEB https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
WEB https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f
PACKAGE https://github.com/vercel/next.js
WEB https://github.com/vercel/next.js/releases/tag/v16.4.1

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes