Next.js ‘use cache’ remote code execution via typed arrays

What it is

Next.js security release, 14 October 2026: “A vulnerability in applications using App Router with Cache Components can lead to unauthenticated remote code execution when a `use cache` function returns multiple typed arrays.”

Vercel says there is no known workaround and to “upgrade immediately even if your application does not have similar functions.” The related upstream React advisory is GHSA-xqc2-xf4c-x3h3.

No CVE ID had been published for this advisory at the time of writing.

How to check

1. Affected: next (npm) 16.0.0 through 16.4.0.
2. You’re exposed if you use the App Router with Cache Components and a ‘use cache’ function returns typed arrays (Uint8Array, Float32Array and so on), but Vercel says to upgrade either way.

How to fix

1. Upgrade next to 16.4.1 or later.

npm ls next
npm install next@16.4.1

Sources

• Next.js: Security update, October 14, 2026 ↗
• GitHub Security Advisory GHSA-673q-mjm6-r5xr ↗