Next.js shipped an out-of-band security update on October 14, 2026, fixing two critical remote code execution flaws and one high-severity denial-of-service bug. Both RCE issues hit App Router applications, one through the use cache caching layer in Next.js 16.0.0 through 16.4.0, the other through SVG image processing going back to 10.0.0. Vercel rated both 9.5 on CVSS. Nothing points to active exploitation as of this writing, but the fix is already out: Next.js 16.4.1 for the 16.x line and 15.5.28 for 15.x.
The use cache RCE has no workaround
The more serious of the two is tracked as GHSA-673q-mjm6-r5xr. It affects App Router apps that have Cache Components turned on. If a use cache function returns more than one typed array, an attacker-controlled value can trigger remote code execution. The root cause actually sits upstream in React itself, in the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages, which is why React published its own advisory alongside Next.js’s.
There’s no mitigation for this one short of upgrading. Vercel’s own write-up says to patch even if your app doesn’t obviously use a function shaped like that, since the trigger condition is narrow but not something you can easily audit for by hand.
The SVG flaw traces back to a memory bug in sharp
The second RCE, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), comes from a memory corruption bug in librsvg, reached through the sharp image library that Next.js’s Image Optimization API uses under the hood. On glibc-based Linux, an attacker-supplied SVG can trigger code execution during image processing. It only bites if SVG handling is turned on through the dangerouslyAllowSVG setting, or if an app uses next/og on the Node.js runtime, which had its own ImageResponse RCE patched back in September. That earlier fix and this one trace to the same underlying librsvg issue, just reached through a different code path.
The fix bumps the bundled sharp dependency to 0.35.5, which pulls in a patched librsvg. If you can’t upgrade Next.js right away, bumping sharp on its own to 0.35.5 or later closes the hole, or you can disable SVG loading entirely with sharp.block({ operation: ["VipsForeignLoadSvg"] }).
A quieter DoS bug rides along
The update also patches GHSA-p3m5-59mp-jv5r, a high-severity denial-of-service flaw in App Router apps using Server Actions. A crafted request can push a server process to full CPU usage, blocking other requests on that process until it recovers. Pages Router apps and anything without a Server Action aren’t affected. Worth flagging separately: this bug and the use cache RCE never got CVE numbers, so they won’t show up in the npm advisory feed and npm audit will miss them entirely. Version-checking your own Next.js dependency is the only way to catch it.
What to actually do about it
- On Next.js 16.x, run
npm install [email protected]and redeploy. - On Next.js 15.x, run
npm install [email protected], then runnpm ls sharpto confirm it pulled 0.35.5 or newer. The 15.x line will still silently accept an older, vulnerable sharp if it’s already pinned elsewhere in your lockfile. - If you can’t patch immediately, at minimum upgrade sharp on its own, since none of the three fixes have a workaround that doesn’t involve touching dependencies.
This is the third image-processing code execution bug traced back to Next.js’s image pipeline since August. For teams running client-facing Next.js apps without a dedicated person tracking framework CVEs, that pattern is exactly the kind of thing a periodic Web Application Development audit is meant to catch before it turns into an incident.
