Next.js use cache can run code when a cached function returns typed arrays

The Next.js advisory published October 14, 2026 says a vulnerability in applications using the App Router with Cache Components can lead to remote code execution. The application needs a use cache function that returns multiple typed arrays. The affected package is next from 16.0.0 through 16.4.0. The patched release is 16.4.1. The advisory says there is no known workaround for affected applications with such functions, and that you should upgrade immediately even if your application does not have similar functions.

The same day's Next.js post names a related React advisory, GHSA-xqc2-xf4c-x3h3. That advisory says crafted payloads targeting frameworks that support React Server Components can lead to remote code execution, only in rare cases where responses transport multiple typed arrays and an attacker-controlled value. It lists react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack for 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. It says apps whose React code does not use a server, and apps that do not use a framework or bundler that supports React Server Components, are not affected.

The October 14 post also publishes Next.js 15.5.28 for other fixes in that release. This advisory's affected range is the 16.0.0 through 16.4.0 line, not 15.x.