Next.js out-of-band security update (14 Oct): two critical unauthenticated RCEs (use cache typed arrays GHSA-673q-mjm6-r5xr; SVG Image Optimization CVE-2026-96889 CVSS 4.0 9.5) plus a high Server Actions DoS; fixed in 16.4.1 and 15.5.28
Vercel published a Next.js Security Update for Upstream Vulnerabilities on 14 October 2026, shipping out-of-band fixes that had been postponed from the September security release while upstream dependencies caught up. Two issues are rated critical at CVSS 4.0 9.5: (1) GHSA-673q-mjm6-r5xr — unauthenticated remote code execution in App Router apps with Cache Components when a use cache function returns multiple typed arrays (affected Next.js 16.0.0 through 16.4.0; fixed in 16.4.1; related React advisory GHSA-xqc2-xf4c-x3h3; no known workaround — upgrade even if you think you lack similar functions); (2) CVE-2026-96889 / GHSA-2464-fhr4-w9xw — unauthenticated RCE via the Image Optimization API when attacker-supplied SVG is processed through sharp on glibc-based Linux (affected 10.0.0–15.5.27 and 16.0.0–16.4.0; fixed in 15.5.28 and 16.4.1; workaround is sharp >= 0.35.5). A third issue, GHSA-p3m5-59mp-jv5r (related React GHSA-h3gv-c5rc-p453), is a high-severity denial of service against App Router apps that expose at least one Server Action (crafted requests can pin CPU and block further requests in the same process; Pages Router or apps without Server Actions are not vulnerable; fixed in the same patched trains). Primary: Next.js blog security update; vendor advisories on GitHub.
- Product
- Next.js (App Router / Image Optimization via sharp; npm package next)
- Versions
- RCE use cache: 16.0.0–16.4.0 fixed in 16.4.1. RCE SVG: 10.0.0–15.5.27 and 16.0.0–16.4.0 fixed in 15.5.28 / 16.4.1 (sharp >= 0.35.5). DoS Server Actions: 13.0.0–15.5.27 and 16.0.0–16.4.0 fixed in 15.5.28 / 16.4.1.
- CVSS
- 9.5 (CVSS 4.0) for both critical RCEs per GitHub advisories; DoS rated High (no separate CVSS published on the Next.js blog summary)
- Exploited in Australia?
- unknown
- Patch to
- Upgrade Next.js to 16.4.1 (Active LTS) or 15.5.28 (Maintenance LTS): npm install next@16.4.1 or npm install next@15.5.28. Confirm sharp is 0.35.5 or later after upgrade. Rebuild and redeploy. Until patched, prefer not to pass untrusted SVG into Image Optimization on glibc Linux hosts.
Primary: Next.js — Security Update for Upstream Vulnerabilities (14 Oct 2026) · Vendor: GitHub advisory GHSA-2464-fhr4-w9xw — CVE-2026-96889 (SVG Image Optimization RCE) · CVE: CVE-2026-96889 · GitHub advisory GHSA-673q-mjm6-r5xr — use cache typed-array RCE