---
title: "GHSA-673q-mjm6-r5xr: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays"
url: https://erroneo.us/security/ghsa/GHSA-673q-mjm6-r5xr/
description: "GHSA-673q-mjm6-r5xr (critical, npm): Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays. Impact A vulnerability in…"
type: advisory
section: "Security Digest"
date_published: 2026-10-22
date_modified: 2026-10-22
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-673q-mjm6-r5xr"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-673q-mjm6-r5xr: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

## Affected packages

- npm `next` >= 16.0.0, <= 16.4.0 → fixed: 16.4.1

## Details

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

## Sources

- [GitHub Advisory GHSA-673q-mjm6-r5xr](https://github.com/advisories/GHSA-673q-mjm6-r5xr)
- [github.com](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr)
- [github.com](https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f)
- [github.com](https://github.com/vercel/next.js/releases/tag/v16.4.1)

---
Source page: https://erroneo.us/security/ghsa/GHSA-673q-mjm6-r5xr/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt