Security Operations
Threat Intelligence
๐Ÿ”Ž
โ“

GHSA-673q-mjm6-r5xr - Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays. ## Workaround There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.
CRITICAL
Severity & confidence
Source severitycritical
Platform severitycritical
Confidencemedium
Exploitationunknown
CVSS-
Affected
Vendorsnext
Productsnext
Reporting sources (1)
GitHub Security Advisories
Open source โ†—
Timeline & provenance
Published2026-10-22T16:42:31
Last updated2026-10-25T02:26:18
Ingested2026-10-22T16:54:35
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
  1. Identify affected systems in your environment.
  2. Apply the vendor patch or mitigation guidance.
  3. Review logs for indicators described in the advisory.
  4. Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a single or secondary source; treat as indicative, verify before acting.
Source type: vendor ยท Original: GitHub Security Advisories