GHSA-673q-mjm6-r5xr: Unauthenticated remote code execution in Next.js cache functions
Summary
GHSA-673q-mjm6-r5xr: Unauthenticated remote code execution can compromise application confidentiality, integrity, and availability. Affects next versions >= 16.0.0, < 16.4.1. Fixed in 16.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a JavaScript web framework in the npm ecosystem. It is used to build web applications, including applications that use the App router and Cache Component. The advisory concerns use cache functions that return multiple typed arrays, a specific configuration described in the affected application behavior.
Vulnerability Detail
Unauthenticated remote code execution can affect applications using the App router with Cache Component and a use cache function that returns multiple typed arrays. The issue is classified as unsafe deserialization (CWE-502). An attacker can execute code remotely without authentication, with potential effects on application confidentiality, integrity, and availability. The advisory identifies the vulnerable behavior but does not provide further technical details about the triggering input or execution path.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.4.1
This is the first release that contains the fix.
npm install next@16.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Documented workaround: No known workaround is available for affected applications with such use cache functions. Upgrade next immediately, even if the application does not have similar functions.
Conclusion
Upgrade next to 16.4.1 to address this vulnerability. Applications using the affected cache behavior should prioritize the upgrade because no workaround is known. Review the dependency recorded in the application lockfile and apply the supplied upgrade command. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for next →
FAQ
next versions from 16.0.0 through 16.4.0 are affected by GHSA-673q-mjm6-r5xr.
GHSA-673q-mjm6-r5xr can allow unauthenticated attackers to execute code remotely in affected next applications.
Upgrade next to the minimum fixed version, 16.4.1, to address GHSA-673q-mjm6-r5xr.
No workaround is known for affected next applications; the advisory recommends upgrading immediately.
Check package-lock.json for the installed next version and compare it with the affected range. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
