{"id":"GHSA-673q-mjm6-r5xr","aliases":[],"url":"https://o3.security/vulnerability/GHSA-673q-mjm6-r5xr","summary":"Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays","details":"## Impact\n\nA vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\n## Workaround\n\nThere is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.","published":"2026-10-22T16:42:31Z","modified":"2026-10-22T17:00:04.201859111Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"next","fixedVersion":"16.4.1"}],"fix":{"url":"https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f","label":"vercel/next.js@a4cea6a"},"references":[{"type":"WEB","url":"https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr"},{"type":"WEB","url":"https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f"},{"type":"PACKAGE","url":"https://github.com/vercel/next.js"},{"type":"WEB","url":"https://github.com/vercel/next.js/releases/tag/v16.4.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-22T17:00:04.201859111Z"}}