PkgSeer

Vulnerability GHSA-673q-mjm6-r5xr

Critical

12 days ago

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

16.0.0 - 16.4.0

Summary

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

Details

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

next.js cache leak across root param values in nested 'use cache' functions

16.3.0 - 16.3.7 GHSA-h694-7cp9-m8p3

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

10.0.0 - 15.5.27 and 16.0.0 - 16.4.0 GHSA-2464-fhr4-w9xw

Next.js: Denial of Service in App Router using Server Actions

13.0.0 - 15.5.27 and 16.0.0 - 16.4.0 GHSA-p3m5-59mp-jv5r

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

16.3.0 - 16.3.7 GHSA-3w37-wq28-93x7

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

15.0.0 - 15.5.26 and 16.0.0 - 16.3.7 GHSA-4jqv-mc3x-m676

View all vulnerabilities for these packages

Impacted packages

next

Timeline

Published

12 days ago

Fixed (16.4.1)

Unknown

Last Modified

12 days ago