Skip to content
Hacker Posts

Next.js ships out-of-band fix for two critical RCE flaws

Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCE flaws — one in use cache, one via SVG image optimization (CVE-2026-96889) — plus a Server Actions DoS.

Published 3 min read
cvenextjsjavascriptadvisory

Vercel shipped an out-of-band Next.js security release on October 14 fixing two critical unauthenticated remote-code-execution bugs and a high-severity denial of service. The fixes are in 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). The primary source is Vercel's advisory, Next.js Security Update for Upstream Vulnerabilities. If you run App Router with Cache Components, upgrade now — there is no workaround for the use cache bug.

What's affected

  • use cache typed-array RCE (GHSA-673q-mjm6-r5xr, Vercel CVSS 9.5). App Router apps with Cache Components where a use cache function returns more than one typed array. The root cause is upstream in React's server-components packages (GHSA-xqc2-xf4c-x3h3, React 19.0.0–19.3.0). Affects Next.js 16.0.0–16.4.0. No workaround — only the upgrade closes it.
  • SVG image-optimization RCE (CVE-2026-96889 / GHSA-2464-fhr4-w9xw, Vercel CVSS 9.5). A memory bug in librsvg, reached through sharp, fires when an app passes attacker-supplied SVGs to the Image Optimization API on glibc Linux. Affects 10.0.0–15.5.27 and 16.0.0–16.4.0. SVG optimization is off by default and requires dangerouslyAllowSVG; the same code path is used by next/og on the Node.js runtime.
  • Server Actions DoS (GHSA-p3m5-59mp-jv5r, High). Crafted requests drive a worker to full CPU, blocking the process. App Router with at least one Server Action; Pages Router apps are not affected.

Exploitation status

As of October 15, Vercel reports no public exploitation of any of the three. There is no public PoC. The SVG bug has a CVE because it stems from the public librsvg flaw (CVE-2026-96889), disclosed September 23 and fixed in sharp 0.35.5 on September 27.

Action checklist

  1. Upgrade now. npm install next@16.4.1 (16.x) or npm install next@15.5.28 (15.x). 16.4.1 pulls sharp 0.35.5 automatically.
  2. If you can't upgrade immediately and use SVG optimization, bump sharp to 0.35.5+ or block SVG loading with sharp.block({ operation: ["VipsForeignLoadSvg"] }). This covers only the SVG path.
  3. For the use cache and DoS bugs there is no mitigation — upgrade is the only fix. Upgrade even if you don't knowingly return typed arrays from cached functions.
  4. Audit next/og usage on the Node runtime; it shares the vulnerable sharp/librsvg path.

Context

This is the third Next.js security cycle in three months after the July and September releases, and the second RCE class to trace back to sharp this year — an AVIF/libheif flaw came through the same library in August. The pattern is consistent: Next.js inherits memory bugs from native image dependencies, and the blast radius is every app that lets user input reach image optimization. The typed-array RCE is the more worrying of the two because it needs no opt-in flag and has no workaround.

Related stories