## Impact
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.
## Workaround
There is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
## Impact
A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.
## Workaround
Ensure the version of `sharp` used by Next.js is greater than or equal to `0.35.5`. Fresh installs automatically get a fixed version of `sharp`.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of `sharp` to Next.js.
Next.js: Denial of Service in App Router using Server Actions
Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.