Next.js out-of-band update fixes two critical unauthenticated RCE flaws

Vercel released an out-of-band security update for Next.js on October 14, 2026, fixing two critical flaws that can lead to unauthenticated remote code execution and a high-severity denial-of-service bug. The fixes ship in Next.js 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). According to the Next.js team, two of the fixes had been postponed from the September security release because of upstream dependency delays.

What happened

The first critical flaw, tracked as GHSA-673q-mjm6-r5xr, affects applications that use the App Router with Cache Components. The Next.js advisory says it can lead to unauthenticated remote code execution when a use cache function returns multiple typed arrays. The root cause is in React Server Components, covered by the upstream React advisory GHSA-xqc2-xf4c-x3h3. Next.js says there is no workaround and urges users to upgrade immediately, even if their application has no such function.

The second critical flaw, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), is a memory bug in an upstream library used for image optimization. According to The Hacker News, the bug is in librsvg, which Next.js reaches through the bundled sharp package, and it can lead to code execution on glibc-based Linux. Vercel rated the Next.js exposure 9.5, while Red Hat scored the underlying CVE 7.8.

The third issue, GHSA-p3m5-59mp-jv5r, lets crafted requests drive CPU usage to the point that a server process stops handling other requests. Only App Router apps with at least one Server Action are affected.

Who is affected

The Hacker News reports that the use cache flaw affects versions 16.0.0 through 16.4.0, the SVG flaw affects 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0, and the DoS affects 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. The publication notes that Next.js does not optimize SVG files by default; exposure requires enabling dangerouslyAllowSVG, although the same library also renders images for next/og on the Node.js runtime.

As of October 15, The Hacker News said there were no public reports of exploitation. It also warned that the use cache and Server Actions advisories have no CVE identifiers and did not appear in the npm advisory feed used by npm audit, so dependency scanners may miss them. The publication added that this is the third image-processing code execution issue in Next.js since August.

What to do

• Upgrade to [email protected] or [email protected], then rebuild and redeploy.
• On version 15, The Hacker News notes that 15.5.28 still accepts older sharp 0.34.x; run npm ls sharp and make sure sharp is 0.35.5 or later.
• As an interim measure for the SVG issue, the Next.js team recommends ensuring sharp 0.35.5 or later; the sharp advisory also describes blocking SVG loading.
• The use cache and Server Actions issues can only be closed by upgrading. Netlify said its platform does not run the affected image-optimizer path but still recommends the update.