GHSA-673q-mjm6-r5xr

Source

https://github.com/advisories/GHSA-673q-mjm6-r5xr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-673q-mjm6-r5xr/GHSA-673q-mjm6-r5xr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-673q-mjm6-r5xr

Downstream

CGA (6)

CLEANSTART (2)

CLSA (1)

CLSA-2026-1793806552

ECHO (1)

ECHO-1db6-e508-2978

ROOT (1)

ROOT-APP-NPM-GHSA-673q-mjm6-r5xr

Published

2026-10-22T16:42:31Z

Modified

2026-10-22T17:00:04Z

Severity

9.5 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N CVSS Calculator

Summary

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

Details

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Database specific

{
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-22T16:42:31Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
}

References

Affected packages

npm / next

Package

Name: next; View open source insights on deps.dev
Purl: pkg:npm/next

Affected ranges

Type: SEMVER
Events: Introduced

16.0.0

Fixed

16.4.1

Database specific

last_known_affected_version_range

"<= 16.4.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-673q-mjm6-r5xr/GHSA-673q-mjm6-r5xr.json"