Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

影響: npm:next >= 16.0.0, <= 16.4.0 → 16.4.1

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

在 GitHub Advisory Database 阅读

2026/10/23 01:42，GitHub Advisory Database 发布了“Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays”（类型：漏洞公告）。严重程度为“严重”（critical）。相关技术：JavaScript / Node.js、Next.js。