GHSA-673q-mjm6-r5xr: Npm/next vulnerability

Q: Which applications are known to be directly exposed to this issue?

Applications using the App Router with Cache Components are directly affected when they contain a `use cache` function that returns multiple typed arrays. The advisory recommends upgrading even if no similar function is currently identified.

Q: Is there a mitigation if an immediate upgrade is not possible?

No known workaround is available for affected applications that have `use cache` functions returning multiple typed arrays. Upgrade immediately.

Published Oct 22, 2026

Updated

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Affected Software

1 affected componentFixes available

npm/next>=16.0.0<=16.4.0

16.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/next to a version that resolves this vulnerability.
Fixed in 16.4.1

Event History

Oct 22, 2026

Advisory Published

via GitHub·04:42 PM

Data Sourced

via GitHub·04:42 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which applications are known to be directly exposed to this issue?

Applications using the App Router with Cache Components are directly affected when they contain a `use cache` function that returns multiple typed arrays. The advisory recommends upgrading even if no similar function is currently identified.

Is there a mitigation if an immediate upgrade is not possible?