next-cache-rce-check

Offline triage for the Next.js use-cache typed-array RCE
GHSA-673q-mjm6-r5xr · offline, single-file, dependency-free

next-cache-rce-check assesses reported Next.js versions, npm dependency metadata, and bounded JS/TS source context against the maintainer advisory for this one issue. It exports canonical JSON, CSV, or a branded HTML report.

It never executes project code, invokes a package manager, or contacts the network. It reports uncertainty honestly: missing, conflicting, or qualified evidence is unknown, never "safe".

[!IMPORTANT] Potential exposure is not confirmed exploitability. Every result keeps exploitability: not_tested. A reported version, lockfile, or source pattern cannot show deployed configuration, vendor backports, or real patch status. Treat each result as a prompt for a maintainer to check.

It follows the conservative reporting and licensing approach of node2shell-check and php2shell-check.

Contents

• Scope
• Requirements
• Quick start
• Usage
• Interpreting results
• Reports and output
• Exit codes and incomplete coverage
• Limitations and bounds
• Documentation
• Development and provenance
• License

Scope

The maintainer advisory identifies Next.js 16.0.0 through 16.4.0 as affected and 16.4.1 as fixed. Its application conditions are App Router, Cache Components, and a use-cache function that returns multiple typed arrays. The maintainer advises upgrading even when the application does not appear to contain matching functions, and lists no known workaround for affected code. See the advisory and the 16.4.1 release.

Release line	Affected (reported)	Fixed in
Next.js 16.0 to 16.4	16.0.0 to 16.4.0	16.4.1

The embedded snapshot was verified 2026-10-23 against the maintainer advisory. No CVE identifier was assigned in the advisory at verification time.

This checker classifies only plain exact versions on the verified 16.0–16.4 release lines. Earlier major versions, prereleases, vendor-qualified versions, and future 16.5+ lines remain unknown. It does not establish whether a reported build was released or whether a vendor backport is present.

Requirements

• Python 3.10 or later on Windows, macOS, or Linux, using only the standard library.
• Either the standalone next_cache_rce_check.py file or a clone of this repository.
• A local project copy you are authorized to read, or a separately obtained Next.js version string. Paths are local; URLs are not inputs.

No Node.js, package manager, network connection, or third-party package is needed.

Quick start

# Compare a version obtained from your deployed dependency.
python next_cache_rce_check.py --next-version 16.4.0

# Inspect a project copy you are authorized to read.
python next_cache_rce_check.py /path/to/project --asset-id service-a

# Save an offline HTML report, with optional branding.
python next_cache_rce_check.py /path/to/project --format html --brand "Example team" --logo team.png --output report.html

# Save canonical JSON for automation; exit 1 on an affected reported version.
python next_cache_rce_check.py /path/to/project --format json --output report.json --fail-on-finding

# Try the artificial fixture without installing anything.
python next_cache_rce_check.py examples/synthetic-project --asset-id synthetic-demo

The fixture is artificial and should report potentially_affected (see examples). Do not install or deploy it.

Usage

Supply a project directory, at least one --next-version, or both. There is no implicit scan of the current directory. --help lists all arguments and --version prints the tool version.

Option	Purpose
PROJECT	Stable application root directory. Run once per application; workspace package graphs and arbitrary nested roots are not resolved.
--next-version VERSION	A reported version of the root Next.js instance. Repeat to preserve multiple observations; disagreement is reported as a conflict, not resolved.
--asset-id LABEL	Non-sensitive label (default project).
--format {json,csv,html}	Report format (default json).
--output PATH	Write the report to a file outside the assessed project directory instead of stdout.
--force	Replace an existing report file. Without it, existing files are preserved.
--brand NAME, --logo PATH	HTML display name (default CompleteTech LLC) and an optional local PNG/JPEG/GIF/WebP logo.
--fail-on-finding, --fail-on-unknown	Exit 1 on a completed report containing potentially_affected or unknown results, respectively.

Report destinations must be outside the assessed project directory, including when --force is used; the checker never writes into the project tree. Accepted exact versions remain attached to their individual evidence sources in JSON, CSV, and HTML even when disagreement makes the selected version unknown. To assess a separately verified version without unsupported project metadata, use --next-version alone. Argument syntax, value limits, and protections are in the CLI reference.

Inputs inspected

Input	Treatment
package-lock.json / npm-shrinkwrap.json, npm versions 1–3	Extract exact resolved Next.js versions, preserving nested instances, canonical npm aliases, and disagreements. A lockfile does not attest installation.
Direct node_modules/next/package.json	Read package identity and reported installed version; disagreement with the lockfile stays unknown.
package.json	Record a dependency-declaration candidate. Exact pins and ranges both remain declarations, never installed-version evidence.
Yarn, pnpm, Bun lockfiles	Explicitly unsupported. Coverage is incomplete and exit code is 2; unsupported inventory prevents a fixed assessment.
JS/TS and conventional App Router files	Bounded lexical context only. No import graph, value-flow analysis, runtime evaluation, or reachability check.

Source evidence is attached only to the direct node_modules/next instance; nested copies have their own version results.

Interpreting results