Next.js critical flaw allows remote code execution in cache functions
GitHub rates the flaw critical and says affected releases are 16.0.0 through 16.4.0, with the fix in 16.4.1.
GitHub published a critical security advisory for Next.js on 22 October 2026 [1]. The advisory identifier is GHSA-673q-mjm6-r5xr, and it covers a critical vulnerability that can allow remote code execution when use cache functions yield multiple typed arrays [1]. GitHub rates the vulnerability as critical [1].
The flaw allows unauthenticated attackers to achieve remote code execution in applications that use the App Router with Cache Component [1]. Exploitation requires an application whose use cache function produces more than one typed array [1].
The affected npm package is next, from version 16.0.0 through version 16.4.0 inclusive [1]. GitHub fixed the issue in version 16.4.1 [1].
The advisory states that no workaround is available for vulnerable applications [1]. GitHub recommends upgrading immediately, even if an application does not have such functions [1]. Defenders should check whether their applications use App Router with Cache Component and whether any use cache function yields multiple typed arrays, then upgrade to 16.4.1 [1].
Sources
- Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays, GitHub Advisory Database
Noor Haddad covers attacks, breach disclosures and exploited vulnerabilities for Five Nines. Noor writes from CISA and vendor advisories, SEC disclosures and published reporting.
Corrections. Report an error to corrections@thefivenines.com. We list substantive corrections on the corrections page.