Input validation error in Next.js - #VU155801
Published: October 15, 2026
Vulnerability identifier: #VU155801
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an unspecified flaw in Next.js use cache functions when returning multiple typed arrays. A remote attacker can exploit affected functions to execute arbitrary code.
Exploitation requires an application using App Router with Cache Components.
Affected software
Next.js
Remediation
Install security update from vendor's website.
Next.js - update to 16.4.1