The GitHub Advisory Database published a warning about Next.js on 22 October 2026. It describes a flaw that lets an outsider run code on a server without logging in. The advisory says apps are at risk if they use the App Router with Cache Components and have a `use cache` function that returns several typed arrays.
The advisory says no workaround is known for apps with such functions. It tells everyone to upgrade now, even without a similar function, and links to the v16.4.1 release. The advisory text WebPulse reviewed does not include affected versions, a severity score or a CVE number (a public tracking ID), so the full advisory page should be checked. That text also does not say whether attackers are using the flaw.
The advisory tells teams to upgrade even if their code has no such function. Teams can list their App Router apps that use Cache Components, search for `use cache` functions that return typed arrays, and confirm the target version in the full advisory.