GHSA-673q-mjm6-r5xr: the Next.js use cache RCE, who is affected and how to fix it

What GHSA-673q-mjm6-r5xr is

use cache is a directive that tells Next.js to store what a function, a component or a whole file returns, and reuse it across requests. It belongs to Cache Components, the caching model you switch on with cacheComponents: true in next.config. The directive arrived as an experimental feature in Next.js 15 and became stable in 16.0.0, behind that flag.

Cached results are stored in React's own serialization format, which accepts typed arrays: fixed-size arrays of binary numbers such as Uint8Array or Float32Array. The advisory says an App Router app with Cache Components is exposed when it has "a use cache function that returns multiple typed arrays", and files the flaw under CWE-502, deserialization of untrusted data. No login is needed. Remote code execution (RCE) means a stranger runs their own commands on your server, with everything the server can reach: environment variables, database credentials, internal services.

The root cause sits upstream, in the React Server Components transport. React published its own critical advisory the same day, GHSA-xqc2-xf4c-x3h3, for react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel. The Next.js fix, a commit titled "Improve Server Component transport protocol", updates the copies of React's server packages that ship inside next.

Severity and exploitation status

React and Netlify both describe the precondition as rare. React says it "only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value". Netlify calls it "an unusual configuration not expected in normally functioning applications". For an app that matches, the impact is still full code execution.

Who is affected

Per the advisory, your app is exposed when all three of these are true:

1. It runs next 16.0.0 to 16.4.0.
2. It uses the App Router with Cache Components enabled, which means cacheComponents: true in next.config. Since 16.0.0, use cache only works with that flag.
3. At least one use cache function, component or file returns multiple typed arrays.

The advisory sets no condition on hosting or operating system, unlike the SVG flaw fixed in the same release, which needs glibc-based Linux. Cache Components requires the Node.js runtime, so the cached function runs in your server's Node.js process wherever that process lives.

The advisory still asks every app on an affected version to upgrade "even if your application does not have similar functions". A typed array can hide inside a nested object or come from a library you did not write.

How to check your Next.js version

Read the version your lockfile resolves, not the range in package.json: "next": "^16.2.0" can install any 16.x from 16.2.0 up. At the root of the project:

# The installed version, from the project root
npm ls next
pnpm why next
yarn why next

# Or straight from the lockfile
grep -A2 '"node_modules/next"' package-lock.json
grep -E "^  '?/?next@" pnpm-lock.yaml

In a monorepo, check each app. npm audit reads the GitHub Advisory Database, which only published the reviewed record on 22 October, a week after the fix, so an audit from mid-October may have missed it. Run it again.

How to find use cache functions in your code

This search tells you how urgent the upgrade is, not whether to do it. Run it in your own project:

# Is Cache Components on?
grep -n "cacheComponents" next.config.*

# Every file with a use cache directive (use cache: remote and use cache: private included)
grep -rnE "^\s*['\"]use cache" . \
  --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' --include='*.mjs' \
  --exclude-dir=node_modules --exclude-dir=.next

# In those files, the lines that mention typed arrays, Buffers or raw bytes
grep -rlZE "^\s*['\"]use cache" . \
  --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' --include='*.mjs' \
  --exclude-dir=node_modules --exclude-dir=.next \
  | xargs -0 -r grep -nHE "(Big)?U?[Ii]nt(8|16|32|64)(Clamped)?Array|Float(16|32|64)Array|Buffer|arrayBuffer"

For each match, read what the function returns, including values nested in objects and arrays. Look for:

• Typed arrays by name: Uint8Array, Int32Array, Float32Array, Float64Array, BigInt64Array and their siblings. A TypeScript return type that names one is the fastest tell.
• Node.js Buffer values. The Node.js docs describe Buffer as a subclass of Uint8Array, and fs.readFile without an encoding returns one, as does sharp(...).toBuffer().
• Bytes read from a response, such as new Uint8Array(await res.arrayBuffer()) after a fetch.
• Values passed through from a database driver or SDK that returns binary columns as Buffer or Uint8Array, where the name never appears in your code.

A match does not prove your app can be exploited, and no match does not clear it. If a cached function on a public server returns several typed arrays, upgrade first, then work through the checklist below.

How to fix GHSA-673q-mjm6-r5xr

1. 1

   Upgrade Next.js

   16.4.1 is the first fixed release. Install the latest 16.x instead, 16.4.5 from the 3 November 2026 security release: npm install [email protected], pnpm add [email protected], yarn add [email protected] or bun add [email protected].

2. 2

   Upgrade next, not only react

   The fix ships inside the next package, in its bundled copies of React's server packages. Bumping react or react-dom alone leaves those copies as they were.

3. 3

   Commit the lockfile and redeploy

   The fix reaches production only through the lockfile. If you build a Docker image, make sure the install step does not come from a stale cache.

4. 4

   Retire old deployments

   Deploy previews, branch deploys and staging copies keep the old version while they stay online. Netlify warns about this for its previews, and it holds on any host that keeps old builds reachable.

What to check after upgrading

• npm ls next, or the pnpm or yarn equivalent, shows 16.4.1 or later for every app in the repository.
• Production was rebuilt from the new lockfile, and old previews and branch deploys are deleted or rebuilt.
• npm audit no longer lists GHSA-673q-mjm6-r5xr.
• If a cached function returned typed arrays on a public server before the upgrade, review that server's logs for the period and rotate the secrets it held if you cannot rule out misuse.

The November release that brought 16.4.5 also fixed advisories where Cache Components served one tenant's cached content to another. The Next.js security guide covers keeping per-user data out of shared caches.

Related Next.js advisories

• GHSA-2464-fhr4-w9xw: the other critical fix in 16.4.1, code execution through SVG images in the image optimizer, also patched in 15.5.28.
• CVE-2026-94482: the Server Actions denial of service fixed in the same release.
• CVE-2025-55182, React2Shell: an earlier code execution flaw in how React Server Components decode requests, listed in CISA's KEV catalog.
• CVE-2026-94483: the image optimizer SSRF fixed in 16.3.8.

Timeline