Next.js: Unauthenticated RCE in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr)
Severity: critical · Patch status: patched · Since 2026-10-14
Vercel disclosed a critical (CVSS 9.5) unauthenticated remote code execution vulnerability in Next.js affecting App Router applications using Cache Components where a use cache function returns multiple typed arrays. All versions from 16.0.0 through 16.4.0 are affected; no workaround exists for applications with such cache functions, and Vercel urges immediate upgrades even for apps without similar functions. The advisory was published Oct 14, 2026 and last updated Oct 22, 2026. No in-the-wild exploitation is reported. The fix is available in Next.js 16.4.1 (commit a4cea6a).
What to do
- Upgrade Next.js to 16.4.1 immediately, even if you don't use `use cache` functions
- Audit App Router code for `use cache` functions returning multiple typed arrays
- If upgrading is delayed, restrict exposure of affected apps at the edge/WAF and monitor for exploitation
- Review Cache Components usage and re-test deployments after upgrade
Fixed versions
Sources
All live incidents on Threat Watch
