Next.js fixes two critical RCE flaws and a CPU DoS
Next.js has fixed two critical remote code execution (RCE) flaws, which could let an unauthenticated attacker run code on a server, plus a high-severity denial-of-service issue. The out-of-band update, issued outside the normal release schedule on October 14, is available as Next.js 16.4.1 and 15.5.28, the current Active and Maintenance long-term support releases. Vercel, which develops Next.js, gave both code-execution vulnerabilities a 9.5 score under the Common Vulnerability Scoring System (CVSS).
The first RCE issue, tracked as GHSA-673q-mjm6-r5xr, affects Next.js 16.0.0 through 16.4.0. Exposure is limited to App Router applications that enable Cache Components and contain a use cache function returning more than one typed array, a structured collection of binary values. Vercel nevertheless recommends upgrading even when an application has no such function. The problem is within React Server Components, a React feature that runs user-interface components on the server rather than entirely in a visitor's browser.
React's related advisory covers react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack versions 19.0.0 through 19.3.0. React describes the affected situation as extremely rare and involving responses that carry multiple typed arrays alongside a value controlled by an attacker. Although the weakness resides in the same three packages associated with React2Shell, it is substantially narrower. React2Shell was a maximum-severity flaw disclosed in December 2025 and exploited at scale.
The second RCE vulnerability is CVE-2026-96889, also tracked as GHSA-2464-fhr4-w9xw. It is a memory-handling error in librsvg, an open-source component used to render Scalable Vector Graphics (SVG) images. Next.js reaches librsvg through sharp, its bundled image-processing package. The vulnerable Next.js ranges are 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. According to the advisory, code execution is possible on Linux systems based on glibc, a core software library used by many Linux distributions, when an application passes an attacker-supplied SVG file to sharp.
Next.js does not optimize SVG files by default. That processing path becomes available when an application enables the dangerouslyAllowSVG setting. The affected library can also render images for next/og, which generates social-preview images, when that feature uses the Node.js runtime, the server-side environment that executes JavaScript. Next.js 16.4.1 requires sharp 0.35.5, which includes patched librsvg 2.63.2. For the version 15 line, the image flaw is addressed by Next.js 15.5.28 together with sharp 0.35.5 or later.
The third issue, GHSA-p3m5-59mp-jv5r, can cause denial of service, meaning legitimate visitors may be unable to use an application. It affects Next.js 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. An App Router application is exposed when it defines at least one Server Action, a function performed on the server in response to an application request. Crafted requests can drive one server process to full CPU use, preventing that process from handling other traffic. Applications using the Pages Router, or App Router applications without Server Actions, are not affected.
Hosting architecture can alter exposure. Netlify said its platform does not execute the affected image-optimizer path and described the impact on its environment as limited, although it still recommends updating. That distinction does not change the general remediation: operators should install Next.js 16.4.1 for version 16 or 15.5.28 for version 15, then rebuild and redeploy the application so the corrected code is actually running.
Version 15 administrators should separately verify sharp after the Next.js upgrade. Although Vercel's advisory says package managers should supply the corrected sharp release automatically, Next.js 15.5.28 still permits the affected sharp 0.34.x branch. Updating an existing installation may consequently leave the older dependency in place. Administrators can run npm ls sharp and explicitly update sharp to 0.35.5 or later if the result shows an earlier version. Version 16.4.1 already requires sharp 0.35.5.
If a Next.js upgrade cannot be completed immediately, the SVG-related risk can be reduced by installing sharp 0.35.5 or later. The sharp advisory also documents blocking SVG rendering with sharp.block({ operation: ["VipsForeignLoadSvg"] }). There is no workaround for the Cache Components RCE or the Server Actions denial-of-service flaw, so installing the corrected Next.js release is the only stated fix for those two issues.
Dependency scanning may not identify the complete set. As of October 15, the Cache Components and Server Actions advisories had no CVE identifiers and were absent from the npm advisory feed used by npm audit. The image-processing vulnerability does appear through sharp's own advisory. Website operators should therefore not treat a clean npm audit result as confirmation that an affected Next.js release is safe.
This is the third code-execution problem since August involving image processing in Next.js. An August libheif flaw reachable through sharp could run code when the optimizer processed a crafted AVIF image. In September, a next/og issue allowed attacker-controlled text to alter the SVG it generated. Next.js 16.4.1 does not change the optimizer code from 16.4.0; it addresses the latest image issue by raising the bundled sharp version to 0.35.5.
CVE-2026-96889 became public on September 23 and was fixed in sharp on September 27. Red Hat scored the underlying issue 7.8 and said exploitation required user interaction, such as opening a malicious file. Vercel rated the Next.js exposure 9.5 because it can be reached over a network. The researcher who reported the librsvg weakness says it is also behind September's next/og flaw, for which a working exploit targeting one specific server configuration has since been published. Sharp's maintainer cautions that the outcome may be either code execution or a crash depending on the server's Node.js build, because official Node.js binaries lack hardening against this type of memory attack.
For businesses reviewing web infrastructure and upgrade responsibilities, AEU-I provides security-first IT, infrastructure and consulting. As of October 15, there were no public reports that attackers had exploited any of the three vulnerabilities fixed on October 14.