GHSA-673q-mjm6-r5xr: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

The advisory is short. It says an application using the App Router with Cache Components can be taken over remotely when it has a use cache function that returns multiple typed arrays. The weakness class is deserialization of untrusted data (CWE-502), and the CVSS 4.0 vector is network-reachable with no privileges and no user interaction. It lists high impact on confidentiality, integrity and availability, and the AT:P element means some deployment-specific precondition must be present, here the vulnerable use cache pattern.

The advisory does not describe the payload or the exact parsing step. The linked fix commit is titled "Improve Server Component transport protocol" and updates the vendored react-server-dom-* packages inside Next.js, which suggests the flaw lives in how data is serialized between server and client. That reading is an inference from the commit, not a statement in the advisory.

Practically, an unauthenticated attacker who can reach a vulnerable app over HTTP could run code in the server process. That gives access to environment variables, database credentials, API keys and anything the Node process can read. The vendor says to upgrade even if you have no function matching the pattern.

next from 16.0.0 up to and including 16.4.0, in App Router projects with Cache Components enabled. Pages Router-only apps and 15.x are outside the listed range.

npm ls next

Check the next entry in your lockfile too, and confirm what your deployed build actually contains, since a container image may lag the repo.

Upgrade to next 16.4.1:

npm install [email protected]

Rebuild and redeploy. The advisory states that there is no known workaround for affected applications and that you should upgrade immediately even if your code has no matching use cache function. If you cannot deploy right away, reduce exposure by limiting access to the app at the network edge, though the advisory does not offer that as a fix. Rotate secrets reachable from the server process if you suspect compromise.

The advisory lists no indicators. Search your code for "use cache" directives and check which of those functions return typed arrays such as Uint8Array or Float32Array. Review server logs for unexpected requests to routes that render cached components, unexpected child processes spawned by the Node process, outbound connections from the app host, and new files in the deploy directory.

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.