Remote code execution in use cache functions returning typed arrays
Original title: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
What happens
An App Router application with Cache Components can be made to run code without authentication if it has a use cache function that returns multiple typed arrays (for example Uint8Array). The weakness is deserialization of untrusted data (CWE-502).
Who is affected
- Next.js 16 with App Router and Cache Components, with a
use cachefunction that returns multiple typed arrays.
Affected and fixed versions
| Affected | Fixed in |
|---|---|
>= 16.0.0, <= 16.4.0 | 16.4.1 |
What to do
- There is no workaround. The advisory says to upgrade immediately, even if your app has no such function.
Check yourself
- Find the directive:
grep -rn "use cache" app src. - Run
npm ls nextand compare with the table below.
Sources
Rewritten from the original advisory; versions from the GitHub Advisory Database (CC-BY-4.0), updated 2026-10-29. Where they differ, the original advisory wins.