Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws

On October 14 the Next.js team shipped an out-of-band security update, closing two critical flaws that let an unauthenticated attacker run code remotely, along with a high-severity denial-of-service issue. The fixes land in versions 16.4.1 and 15.5.28 — the current Active and Maintenance long-term support releases.

What was fixed

Vercel rated both code-execution flaws critical, each with a CVSS score of 9.5.

The first sits in React Server Components, the feature that runs interface components on the server. It affects "extremely rare cases" where a response transports multiple typed arrays and an attacker-controlled value. In a Next.js app the trigger is a use cache function returning more than one typed array, so only version 16 apps with Cache Components enabled are exposed. Vercel urges everyone to upgrade regardless.

The second (CVE-2026-96889) is a memory bug in librsvg, which Next.js reaches through the bundled sharp package when handling SVG images. Code execution is possible when Next.js runs on glibc-based Linux. By default SVGs are not optimized: enabling that requires a setting called dangerouslyAllowSVG. The same library also powers next/og, the social-preview image generator.

The third flaw is denial of service: in App Router apps with at least one Server Action, crafted requests can pin one process at full CPU and stop it serving other requests.

What to do

Upgrade to 16.4.1 (if you run version 16) or 15.5.28 (if you run version 15), then rebuild and redeploy. On version 16 the required sharp 0.35.5 is pulled in automatically; on 15.5.28, however, the older vulnerable sharp 0.34.x is still accepted, so check with npm ls sharp and update it manually if needed.

If you cannot upgrade at once, the image flaw has an interim option — update sharp or block SVG rendering with sharp.block({ operation: ["VipsForeignLoadSvg"] }). The use cache and Server Actions flaws have no workaround.

Why images keep failing

This is the third time since August that image processing in Next.js has produced a code-execution flaw: earlier it was libheif parsing AVIF, then next/og generating SVG. This time the optimizer's own code was untouched — the fix simply raises sharp to 0.35.5, which carries a patched librsvg 2.63.2. Red Hat scored the underlying bug 7.8 (requiring user interaction), while Vercel rated the Next.js exposure 9.5 and reachable over the network.

The React Server Components flaw lives in the same three packages as December's React2Shell, but is far narrower in scope. As of October 15 there were no reports of any of the three flaws being exploited.

Source: The Hacker News