GHSA-673q-mjm6-r5xr is a critical flaw in Next.js 16 applications that use the App Router with Cache Components. Vercel says it can lead to unauthenticated remote code execution when a use cache function returns multiple typed arrays. The advisory rates it 9.5 on CVSS v4.0. It is fixed in Next.js 16.4.1 and has no workaround.
- 01GHSA-673q-mjm6-r5xr is a critical Next.js flaw, 9.5 on CVSS v4.0. It can lead to remote code execution in App Router apps with a use cache function that returns multiple typed arrays.
- 02It affects Next.js 16.0.0 to 16.4.0 and is fixed in 16.4.1. Vercel says there is no workaround and to upgrade even without such a function.
- 03A public proof-of-concept repository exists. The flaw has no CVE id as of 23 October 2026.
What It Allows.
Vercel’s advisory says an application that uses the App Router with Cache Components can be open to remote code execution without a login. The trigger is a use cache function that returns multiple typed arrays. The CVSS v4.0 vector rates it Critical, 9.5: reachable over the network, no privileges, no user interaction, with attack requirements present.
Vercel names the React advisory GHSA-xqc2-xf4c-x3h3, tracked as CVE-2026-126187 since 10 November 2026, as related. React says crafted payloads aimed at frameworks that support React Server Components can lead to remote code execution. It adds that this affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.
A public repository created on 17 October 2026 claims to hold a working proof of concept. Its author says a cached response written with two large typed-array views loses part of its data. When the server reads it back, it treats attacker-supplied bytes as protocol rows. The author says the forged rows can call a Server Action with attacker-chosen arguments, and in the lab that action ran a shell helper. We did not run the code and cannot confirm these claims. If the author is right, the damage depends on what your Server Actions do.
Vercel says the release includes two fixes postponed from the September security release because of upstream dependency delays. It does not say which two.
Who Is Affected.
The advisory lists Next.js 16.0.0 to 16.4.0 as affected. The patched version is 16.4.1. Next.js 15 is not listed for this flaw. The 15.5.28 release fixes the image and Server Actions flaws only.
The React packages react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel are affected in 19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8 and 19.3.0. React fixed them in 19.0.9, 19.1.10, 19.2.9 and 19.3.1. React says an app is not affected if its React code does not use a server, or if it uses no framework or bundler plugin that supports React Server Components.
Vercel says there is no known workaround and tells you to upgrade even if your application has no such function. Treat every App Router application on 16.0.0 to 16.4.0 as in scope until it is patched.
The same release also fixed the Image Optimization flaw CVE-2026-96889. For how the two flaws differ and how to confirm both fixes, read our Next.js RCE patch check.
npm ls nextTimeline.
- 14 Oct 2026 Vercel publishes Next.js 16.4.1 and the advisory GHSA-673q-mjm6-r5xr, rated Critical. React publishes the related advisory GHSA-xqc2-xf4c-x3h3 (CVE-2026-126187 since 10 November 2026) and fixed server-dom packages on the same day.
- 17 Oct 2026 A public GitHub repository appears that claims to hold a proof of concept for the flaw.
- 22 Oct 2026 GitHub’s global advisory record for the Next.js advisory is published, still without a CVE id.
What To Do.
-
01
Find your Next.js version
Run npm ls next in each project and container image. Versions 16.0.0 to 16.4.0 are affected. Versions 15.x are not listed for this flaw.
$ npm ls next - 02 Update Next.js Install next@16.4.1 or later, rebuild the image and redeploy. The 16.4 line is at 16.4.3 as of 23 October 2026. Vercel says there is no workaround, so do not wait to find out whether you use the function.
-
03
Check the React packages
Run npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel. Anything in the affected ranges needs 19.0.9, 19.1.10, 19.2.9 or 19.3.1. Other frameworks that support React Server Components can pull these packages in.
$ npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel - 04 Search for the pattern Look for the use cache directive and for functions that return more than one typed array, such as Uint8Array or Buffer views. This tells you how urgent it is, not whether to patch.
- 05 Review your Server Actions List the Server Actions your application exposes and what each one does. A public write-up claims the flaw can reach a Server Action with chosen arguments, so any action that touches a shell, files or a database needs a close look.
- 06 Look for signs of abuse Watch for web processes that start shells or download tools, and for unusual requests with long encoded values. The public write-up says a vulnerable cached function failed on read-back with the error Connection closed in its lab. The vendor advisories publish no indicators of compromise.
Questions.
Not as of 23 October 2026. The Next.js advisory and GitHub’s global advisory record list no CVE id. Search your scanners and audit tools by the GHSA id.
In Our Research.
Sources.
- Next.js Security Update for Upstream Vulnerabilities (14 October 2026)Next.js ↗
- Unauthenticated Remote Code Execution in use cache functions returning typed arraysGitHub ↗
- Unauthenticated Remote Code Execution in React Server ComponentsReact ↗
- Next.js v16.4.1 release notesGitHub ↗
- Known Exploited Vulnerabilities catalogCISA ↗
Last updated 23 October 2026 · Brandefense Research Team
