News Vulnerabilities & Zero-Days

Next.js fixes two critical unauthenticated RCE flaws in out-of-band update

Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote code execution flaws, one in use cache functions and one in SVG image optimization, plus a high-severity denial of service in Server Actions. There is no workaround for two of the three.

Published Updated
Illustration of a web app framework shaped as stacked glass layers, with a crack running through a cache layer and an image file.

Key takeaways

  • Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote code execution flaws.
  • One affects use cache functions in App Router with Cache Components; there is no workaround.
  • The other affects SVG image optimization on glibc-based Linux through the sharp library.
  • A high-severity Server Actions flaw can tie up a server process with crafted requests.
  • npm audit may not flag two of the advisories yet, so upgrade and confirm sharp 0.35.5 or later.

Vercel released Next.js 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS) on 14 October 2026 to fix three security issues, two of them rated critical. Vercel says developers should patch immediately.

npm install [email protected]   # for 16.4
npm install [email protected]  # for 15.5

What are the vulnerabilities? #

Advisory Severity What it allows When an app is affected
GHSA-673q-mjm6-r5xr Critical Unauthenticated remote code execution App Router with Cache Components, when a use cache function returns multiple typed arrays
CVE-2026-96889 (GHSA-2464-fhr4-w9xw) Critical Unauthenticated remote code execution Image Optimization of SVG files on glibc-based Linux
GHSA-p3m5-59mp-jv5r High Denial of service through excessive CPU use App Router with at least one Server Action

use cache. The flaw sits in React Server Components, and React has a matching advisory, GHSA-xqc2-xf4c-x3h3. Vercel says there is no workaround and that you should upgrade even if your app has no use cache function that returns typed arrays. Vercel rates it 9.5, The Hacker News reported.

SVG image optimization. A memory bug in an upstream library used for image optimization can lead to code execution. The Hacker News reports the bug is in librsvg, reached through the sharp image library, and that Next.js does not optimize SVGs by default; serving them through the optimizer requires dangerouslyAllowSVG.

Server Actions. Crafted requests can drive a server process to full CPU and block other requests. Apps using the Pages Router, or with no Server Actions, are not affected.

How do I make sure the image fix is applied? #

Vercel says to make sure the version of sharp used by Next.js is 0.35.5 or later; upgrading Next.js lets package managers pull in a fixed sharp. The Hacker News notes that on version 15, 15.5.28 may still allow an older sharp, so run npm ls sharp and update it if needed.

Is it being exploited? #

The Hacker News reported no public evidence of exploitation as of 15 October. It also noted that the use cache and Server Actions advisories had no CVE and might not be flagged by npm audit yet, so do not rely on a clean audit.

What should Next.js teams do? #

  1. Upgrade to 16.4.1 or 15.5.28, then rebuild and redeploy. A dependency bump does nothing until the new build is live.
  2. Run npm ls sharp and confirm 0.35.5 or later.
  3. If you allow SVGs through the image optimizer and cannot upgrade yet, update sharp directly as Vercel's interim fix.

Sources

  1. Next.js security update for upstream vulnerabilities, Vercel (Next.js)

Questions this raises

Do I need to upgrade if I do not use use cache?
Yes. Vercel says to upgrade immediately even if your application has no similar functions.
Are SVG images optimized by default?
No, according to The Hacker News. Serving SVGs through the image optimizer requires dangerouslyAllowSVG. Upgrading is still recommended.
Is it being exploited?
The Hacker News reported no public evidence of exploitation as of 15 October 2026.

Application SecurityVulnerabilityOpen Source SecuritySecurity UpdateNext.js