Article
Next.js Critical RCE Flaws: How to Check Your Patch Landed
Two critical Next.js RCE vulnerabilities were fixed on 14 October. Check sharp, React packages and use cache code, plus what GitHub, X and dark…
Read more
Vulnerability
Next.js use cache remote code execution (GHSA-673q-mjm6-r5xr)
A critical flaw in Next.js 16 applications that use the App Router with Cache Components.
- CVE ID
- GHSA-673q-mjm6-r5xr
- CVSS
- 9.5 Critical (CVSS v4.0, Next.js GitHub advisory)
- Affected product
- Next.js 16 (App Router with Cache Components) and the React server-dom packages
- Exploited
- Unknown
- Published
- October 2026
In short
GHSA-673q-mjm6-r5xr is a critical flaw in Next.js 16 applications that use the App Router with Cache Components. Vercel says it can lead to unauthenticated remote code execution when a use cache function returns multiple typed arrays. The advisory rates it 9.5 on CVSS v4.0. It is fixed in Next.js 16.4.1 and has no workaround.
- CVEGHSA-673q-mjm6-r5xr
- ProductVercel Next.js 16 (App Router with Cache Components) and the React server-dom packages
- Fix Steps6actions listedFind your Next.js version · Update Next.js
What it allows
Vercel's advisory says an application that uses the App Router with Cache Components can be open to remote code execution without a login. The trigger is a use cache function that returns multiple typed arrays. The CVSS v4.0 vector rates it Critical, 9.5: reachable over the network, no privileges, no user interaction, with attack requirements present.
Vercel names the React advisory GHSA-xqc2-xf4c-x3h3 as related. React says crafted payloads aimed at frameworks that support React Server Components can lead to remote code execution. It adds that this affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.
A public repository created on 17 October 2026 claims to hold a working proof of concept. Its author says a cached response written with two large typed-array views loses part of its data. When the server reads it back, it treats attacker-supplied bytes as protocol rows. The author says the forged rows can call a Server Action with attacker-chosen arguments, and in the lab that action ran a shell helper. We did not run the code and cannot confirm these claims. If the author is right, the damage depends on what your Server Actions do.
Vercel says the release includes two fixes postponed from the September security release because of upstream dependency delays. It does not say which two.
Who is affected
The advisory lists Next.js 16.0.0 to 16.4.0 as affected. The patched version is 16.4.1. Next.js 15 is not listed for this flaw. The 15.5.28 release fixes the image and Server Actions flaws only.
The React packages react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel are affected in 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0. React fixed them in 19.0.9, 19.1.10, 19.2.9 and 19.3.1. React says an app is not affected if its React code does not use a server, or if it uses no framework or bundler plugin that supports React Server Components.
Vercel says there is no known workaround and tells you to upgrade even if your application has no such function. Treat every App Router application on 16.0.0 to 16.4.0 as in scope until it is patched.
The same release also fixed the Image Optimization flaw CVE-2026-96889. For how the two flaws differ and how to confirm both fixes, read our Next.js RCE patch check.
Timeline
- 14 Oct 2026
Vercel publishes Next.js 16.4.1 and the advisory GHSA-673q-mjm6-r5xr, rated Critical. React publishes the related advisory GHSA-xqc2-xf4c-x3h3 and fixed server-dom packages on the same day.
- 17 Oct 2026
A public GitHub repository appears that claims to hold a proof of concept for the flaw.
- 22 Oct 2026
GitHub's global advisory record for the Next.js advisory is published, still without a CVE id.
What to do
-
Find your Next.js version
Run npm ls next in each project and container image. Versions 16.0.0 to 16.4.0 are affected. Versions 15.x are not listed for this flaw.
-
Update Next.js
Install next@16.4.1 or later, rebuild the image and redeploy. The 16.4 line is at 16.4.3 as of 23 October 2026. Vercel says there is no workaround, so do not wait to find out whether you use the function.
-
Check the React packages
Run npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel. Anything in the affected ranges needs 19.0.9, 19.1.10, 19.2.9 or 19.3.1. Other frameworks that support React Server Components can pull these packages in.
-
Search for the pattern
Look for the use cache directive and for functions that return more than one typed array, such as Uint8Array or Buffer views. This tells you how urgent it is, not whether to patch.
-
Review your Server Actions
List the Server Actions your application exposes and what each one does. A public write-up claims the flaw can reach a Server Action with chosen arguments, so any action that touches a shell, files or a database needs a close look.
-
Look for signs of abuse
Watch for web processes that start shells or download tools, and for unusual requests with long encoded values. The public write-up says a vulnerable cached function failed on read-back with the error Connection closed in its lab. The vendor advisories publish no indicators of compromise.
Questions
Does GHSA-673q-mjm6-r5xr have a CVE id?
Not as of 23 October 2026. The Next.js advisory and GitHub's global advisory record list no CVE id. Search your scanners and audit tools by the GHSA id.
Which Next.js version fixes it?
Next.js 16.4.1, published on 14 October 2026. Versions 16.0.0 to 16.4.0 are affected. Next.js 15 is not listed for this flaw.
Is there a workaround?
Vercel says there is no known workaround. It tells you to upgrade immediately, even if your application has no use cache function like the one described.
Is GHSA-673q-mjm6-r5xr exploited in the wild?
The CISA catalog lists CVE ids, and this flaw has none. A public repository claims a proof of concept, so patch now.
How is it different from CVE-2026-96889?
CVE-2026-96889 sits in the Image Optimization API and needs SVG input on glibc-based Linux. This flaw sits in cached server-side data and affects only Next.js 16. Both are fixed in 16.4.1.
In our research
Sources
- Next.js Security Update for Upstream Vulnerabilities (14 October 2026) Next.js
- Unauthenticated Remote Code Execution in use cache functions returning typed arrays GitHub
- Unauthenticated Remote Code Execution in React Server Components React
- Next.js v16.4.1 release notes GitHub
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 69 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.