Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Next.js Ships Emergency Patch for Two Critical RCE Flaws and a Server Actions DoS

Next.js 16.4.1 and 15.5.28 fix two CVSS 9.5 code-execution bugs, one in use cache and one in SVG processing via sharp/librsvg, plus a Server Actions DoS. Two of them have no CVE yet, so npm audit may not flag them.

4T4Tify Team4Tify
Oct 15, 2026·5 min read
Next.js Ships Emergency Patch for Two Critical RCE Flaws and a Server Actions DoS

Next.js out-of-band patch: two critical RCE bugs and a Server Actions DoS

Vercel released an out-of-band Next.js security update on October 14, 2026. It fixes two critical remote code execution (RCE) flaws and one high-severity denial-of-service bug. The patched releases are 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). Vercel rates both code-execution issues CVSS 9.5.

What happened

The update fixes three separate problems:

IssueAffectedFixed inExposed when
RCE via use cache (GHSA-673q-mjm6-r5xr)16.0.0 – 16.4.016.4.1App Router plus Cache Components, with a use cache function that returns more than one typed array
RCE via SVG processing (CVE-2026-96889, GHSA-2464-fhr4-w9xw)10.0.0 – 15.5.27, 16.0.0 – 16.4.016.4.1, or 15.5.28 with sharp ≥ 0.35.5Attacker-supplied SVGs reach sharp on glibc-based Linux
DoS via Server Actions (GHSA-p3m5-59mp-jv5r)13.0.0 – 15.5.27, 16.0.0 – 16.4.015.5.28, 16.4.1App Router apps with at least one Server Action

1. React Server Components / use cache. The bug is in React's server-side rendering packages (react-server-dom-webpack, -parcel and -turbopack, versions 19.0.0–19.3.0). React says it affects only very rare cases: a response has to carry several typed arrays together with a value the attacker controls. In Next.js, that means Cache Components are enabled and a use cache function returns more than one typed array. Vercel still recommends upgrading even if you don't have such a function.

2. librsvg memory corruption through sharp. Next.js reaches librsvg through its bundled sharp dependency. Code execution is possible on glibc-based Linux. SVG optimization is off by default, and you have to set dangerouslyAllowSVG to enable it. However, next/og (social preview images on the Node.js runtime) uses the same library path. Red Hat scores the underlying librsvg bug 7.8 and says exploitation requires user interaction. Vercel scores the Next.js exposure 9.5 because a server can reach it over the network.

3. Server Actions DoS. If an App Router app defines at least one Server Action, crafted requests can push a server process to 100% CPU and stop it from serving other traffic. Pages Router apps and apps with no Server Actions are not affected.

Exposure also depends on where the app is hosted. Netlify says its platform doesn't run the vulnerable image-optimizer path, but it still recommends the upgrade.

Why it matters

  • Image handling in Next.js keeps producing bugs. This is the third code-execution issue in Next.js image handling since August: a libheif/AVIF bug, then a next/og SVG-injection issue, and now this one. The researcher who reported the librsvg bug says it is the root weakness behind September's next/og flaw. A public exploit for that earlier flaw already exists, although it targets one specific setup.
  • Your scanners may not flag it. As of October 15, the use cache and Server Actions advisories had no CVE and did not appear in the npm advisory feed. That means npm audit and many SCA tools will not report them. Only the image flaw shows up, through sharp's own advisory.
  • Version 15 can stay vulnerable after the upgrade. Next.js 15.5.28 still accepts the vulnerable sharp 0.34.x, so upgrading on top of an existing lockfile can leave the old library installed.
  • The impact depends on the Node.js build. sharp's maintainer warns that the official Node.js binaries aren't hardened against this type of memory corruption. On those builds the result could be code execution rather than just a crash.

This is not React2Shell. The RSC bug is in the same packages as the maximum-severity flaw from December 2025, but its preconditions are much narrower. As of October 15 there were no public reports of exploitation for any of the three issues.

What to do

  1. Upgrade. Move to Next.js 16.4.1 (v16) or 15.5.28 (v15), then rebuild and redeploy.
  2. Check sharp yourself on v15. Run npm ls sharp and make sure it resolves to 0.35.5 or later. If not, update it explicitly. On v16, 16.4.1 already requires 0.35.5.
  3. Interim mitigation for the SVG bug if you can't upgrade Next.js yet: pin sharp ≥ 0.35.5, or block SVG decoding with sharp.block({ operation: ["VipsForeignLoadSvg"] }). The use cache and Server Actions bugs have no workaround. Only the upgrade fixes them.
  4. Inventory your exposure. Find out where you use dangerouslyAllowSVG, next/og on the Node.js runtime, Cache Components and Server Actions, and prioritize those apps.
  5. Check versions manually. Because two of the advisories have no CVE yet, don't rely on npm audit alone. Compare installed Next.js versions against the fixed releases across all your repos and container images.
  6. Watch for resource exhaustion. Until every app is patched, alert on sustained CPU saturation in Next.js server processes. It may be an early sign that someone is abusing the Server Actions bug.

Originally reported by The Hacker News. This summary and analysis are 4Tify's own.

SHARE