Next.js ships out-of-band fix for two critical RCE flaws
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCE flaws — one in use cache, one via SVG image optimization (CVE-2026-96889) — plus a Server Actions DoS.
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCE flaws — one in use cache, one via SVG image optimization (CVE-2026-96889) — plus a Server Actions DoS.