Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 4, published 22 October 2026.

Which products and versions are affected?

next (npm) >= 16.0.0, <= 16.4.0, SEMVER:introduced=16.0.0,fixed=16.4.1; Vercel Next.js 16.0.0 through 16.4.0, 16.0.0 to 16.4.0.

Is there a fix for This vulnerability?

Yes. next (npm): upgrade to 16.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Vercel Next.js remote code execution in use cache functions

Q: Is there a fix for This vulnerability?

Yes. next (npm): upgrade to 16.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 4 · Published 2026-10-22

Next.js is a React framework that applications use to build web servers and backend services. A vulnerability in the App Router's Cache Component allows unauthenticated attackers to execute arbitrary code on affected servers if the application uses `use cache` functions that return multiple typed arrays. This could lead to complete compromise of the application and underlying system.

Technologies: next (npm), Vercel Next.js. Vendors: npm, Vercel.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 4, published 22 October 2026.
Which products and versions are affected?: next (npm) >= 16.0.0, <= 16.4.0, SEMVER:introduced=16.0.0,fixed=16.4.1; Vercel Next.js 16.0.0 through 16.4.0, 16.0.0 to 16.4.0.
Is there a fix for This vulnerability?: Yes. next (npm): upgrade to 16.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next (npm): upgrade to 16.4.1 or later
```
npm install next@16.4.1
```

Technical details

The vulnerability is a deserialization flaw (CWE-502) in the Server Component transport protocol that affects Next.js versions 16.0.0 through 16.4.0. Applications using App Router with `use cache` functions returning multiple typed arrays are vulnerable to network-based RCE attacks without authentication. The fix improves the Server Component transport protocol to safely handle typed array serialization.

Affected products

Vercel Next.js 16.0.0 to 16.4.0

Timeline

2026-10-14: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.