Critical 9.5/10 RCE hits Next.js use cache; patch 16.4.1 now
jedisct1 · x · 2026-10-16
A new Critical (9.5/10) vulnerability GHSA-673q-mjm6-r5xr affects Next.js apps using App Router with a use cache function returning multiple typed arrays, allowing unauthenticated remote code execution. Versions >=16.0.0 to <=16.4.0 are affected; 16.4.1 is the patched release.
More from coding & agent
- Marc Lou praises PostShiba, a cute indie alternative to AWS SES for email infra — marclou · 2026-10-16
- RExBench: best coding agent completes only 33% of autonomous research extensions — najoungkim · 2026-10-16
- Wiring Pstack skills from a Grok bot into Hermes agent loops — alexcovo_eth · 2026-10-16
- past.dev launches long-term memory API for AI agents, tops BEAM public benchmark — thisiskp_ · 2026-10-16
- Google's CLASHarness benchmarks multi-agent conflicts in computer use, finds frontier VLMs struggle — google · 2026-10-16
- mitsuhiko's AI agent solved multiplayer with PeerJS before he could explain it — mitsuhiko · 2026-10-16