GHSA-673q-mjm6-r5xr
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.
- No known exploitation
- Severity
- Critical, CVSS 9.5 (v4.0)
- Affected packages
- next (npm) >= 16.0.0, <= 16.4.0, fixed in 16.4.1 · GHSA-673q-mjm6-r5xr