GHSA-673q-mjm6-r5xr: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

October 22, 2026

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

References

github.com/advisories/GHSA-673q-mjm6-r5xr
github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f
github.com/vercel/next.js/releases/tag/v16.4.1
github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr

Code Behaviors & Features

Detect and mitigate GHSA-673q-mjm6-r5xr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →