Security Digest · Critical advisory (no CVE assigned)
GHSA-673q-mjm6-r5xr: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution.
CVSS 9.5 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
npm audit (or: npm ls <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | next | >= 16.0.0, <= 16.4.0 | 16.4.1 |
Details
Impact
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.
Workaround
There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
CVSS: 9.5 (v4.0) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
Sources and references
- GitHub Advisory GHSA-673q-mjm6-r5xr github.com
- github.com github.com
- github.com github.com
- github.com github.com