Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, plus a high-severity denial-of-service flaw. Vercel, which develops Next.js, rated both code-execution flaws 9.5 on the CVSS scale. The fixes are in Next.js 16.4.1 and 15.5.28. According to The Hacker News, there are no public reports that any of the three has been used in attacks as of October 15.
One code-execution flaw sits in React Server Components. React’s advisory describes it as affecting “extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value,” and in Next.js the trigger is a use cache function that returns more than one typed array. The other, CVE-2026-96889, is a memory bug in librsvg, the library that renders SVG images, which Next.js reaches through the bundled sharp package. It allows code execution on glibc-based Linux. The denial-of-service flaw lets crafted requests push one server process to full CPU use in App Router apps that define at least one Server Action. The React flaw affects the same three packages as React2Shell, but is far narrower; see our April report on React2Shell. It is also the latest image-processing code-execution bug in Next.js after the AVIF flaw in our August 28 post.
How to check if you’re affected
Affected versions depend on the flaw:
use cachecode execution (GHSA-673q-mjm6-r5xr): Next.js 16.0.0 through 16.4.0, only for App Router apps with Cache Components enabled. The React packagesreact-server-dom-webpack,react-server-dom-parcelandreact-server-dom-turbopack19.0.0 through 19.3.0 are affected.- SVG code execution (CVE-2026-96889, GHSA-2464-fhr4-w9xw): Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0, for apps that pass attacker-supplied SVG files to
sharpon glibc-based Linux. Next.js does not optimize SVGs by default; serving them through the image optimizer requiresdangerouslyAllowSVG. The same library also rendersnext/ogimages on the Node.js runtime. - Server Actions denial of service (GHSA-p3m5-59mp-jv5r): Next.js 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0, for App Router apps with at least one Server Action. Pages Router apps are not affected.
Upgrade to 16.4.1 on version 16, or 15.5.28 on version 15, then rebuild and redeploy. Vercel says to upgrade even if your app has no use cache function. On version 15, run npm ls sharp and update sharp to 0.35.5 or later if it is older, because 15.5.28 still accepts the affected 0.34.x line. If you cannot upgrade yet, the image flaw has an interim option: use sharp 0.35.5 or later, or block SVG rendering with sharp.block({ operation: ["VipsForeignLoadSvg"] }). The use cache and Server Actions flaws have no workaround. As of October 15 those two had no CVE and were not in the npm advisory feed, so npm audit may not warn you.
Sources
- Next.js: Security update, October 14, 2026
- GHSA-673q-mjm6-r5xr: use cache code execution
- GHSA-2464-fhr4-w9xw: SVG code execution (CVE-2026-96889)
- GHSA-p3m5-59mp-jv5r: Server Actions denial of service
- React security advisory GHSA-xqc2-xf4c-x3h3
- Netlify changelog: Next.js and React security vulnerabilities
- The Hacker News: Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing