# Vercel Next.js remote code execution in use cache functions

Source: https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ac3e73d3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 4 · Published 2026-10-22

Next.js is a React framework that applications use to build web servers and backend services. A vulnerability in the App Router's Cache Component allows unauthenticated attackers to execute arbitrary code on affected servers if the application uses `use cache` functions that return multiple typed arrays. This could lead to complete compromise of the application and underlying system.

Technologies: [next (npm)](https://junglewise.ai/threats/technologies/npm-next), [Vercel Next.js](https://junglewise.ai/threats/technologies/next-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 4, published 22 October 2026.

**Which products and versions are affected?** next (npm) >= 16.0.0, <= 16.4.0, SEMVER:introduced=16.0.0,fixed=16.4.1; Vercel Next.js 16.0.0 through 16.4.0, 16.0.0 to 16.4.0.

**Is there a fix for This vulnerability?** Yes. next (npm): upgrade to 16.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run next (npm) or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- next (npm): upgrade to 16.4.1 or later

  ```sh
  npm install next@16.4.1
  ```


## Technical details

The vulnerability is a deserialization flaw (CWE-502) in the Server Component transport protocol that affects Next.js versions 16.0.0 through 16.4.0. Applications using App Router with `use cache` functions returning multiple typed arrays are vulnerable to network-based RCE attacks without authentication. The fix improves the Server Component transport protocol to safely handle typed array serialization.

## Affected products

- Vercel Next.js 16.0.0 to 16.4.0

## Timeline

- 2026-10-14: disclosed
- 2026-10-14: patched

## References

- [https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr)
- [https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f](https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f)

## Related threats

- [Next.js denial of service in App Router with Server Actions](https://junglewise.ai/threats/cve-2026-94482-next-js-denial-of-service-in-app-router-using-server-actions)
- [Next.js unauthenticated remote code execution in Image Optimization API](https://junglewise.ai/threats/next-js-unauthenticated-remote-code-execution-in-image-optimization-api-f1b22a87)
- [Next.js information disclosure in Draft Mode via use cache](https://junglewise.ai/threats/cve-2026-94544-next-js-is-a-react-framework-for-building-full-stack-web)
- [Next.js Pages Router response cache key bypass](https://junglewise.ai/threats/cve-2026-94543-next-js-is-a-react-framework-for-building-full-stack-web)
- [Vercel Next.js information disclosure in dev server MCP endpoint](https://junglewise.ai/threats/cve-2026-94486-next-js-is-a-react-framework-for-building-full-stack-web)