On October 14, **Next.js** pushed an out-of-band security update, **Next.js 16.4.1** and **15.5.28**, to mitigate two critical remote code execution (RCE) vulnerabilities and a high-severity denial-of-service (DoS) flaw. These issues were rated with a **CVSS** score of 9.5 by **Vercel**, the developer behind **Next.js**, highlighting their severe potential impact. ### Critical Flaws Addressed The update targets three distinct security issues: * **Code execution through `use cache` (GHSA-673q-mjm6-r5xr):** This RCE flaw affects **React Server Components** in **Next.js** versions 16.0.0 through 16.4.0. It is triggered when `use cache` functions return more than one typed array in **App Router** apps with **Cache Components** enabled. * **Code execution through SVG images (CVE-2026-96889, GHSA-2464-fhr4-w9xw):** This RCE vulnerability stems from a memory bug in **librsvg**, an open-source library used by **Next.js** via the `sharp` package for SVG image handling. It impacts versions 10.0.0 through 15.5.27, and 16.0.0 through 16.4.0, particularly on glibc-based Linux systems where attacker-supplied SVG files are passed to `sharp`. * **Denial of service through Server Actions (GHSA-p3m5-59mp-jv5r):** A high-severity DoS flaw affecting **Next.js** versions 13.0.0 through 15.5.27, and 16.0.0 through 16.4.0. This can be exploited in **App Router** apps with at least one **Server Action**, allowing crafted requests to exhaust CPU resources and halt server response. ### Who is Affected? The `use cache` RCE primarily impacts **Next.js** version 16 applications that utilize **Cache Components**. While **React's** advisory describes it as affecting "extremely rare cases," **Vercel** strongly recommends upgrading regardless of whether such functions are explicitly used. The SVG image RCE, **CVE-2026-96889**, is a memory bug in **librsvg** that can lead to code execution when **Next.js** runs on glibc-based Linux. This vulnerability is especially critical if applications handle untrusted SVG inputs or use the `dangerouslyAllowSVG` setting for the image optimizer, or if `next/og` (for social-preview images) runs on the **Node.js** runtime. The DoS flaw affects **App Router** applications that have defined at least one **Server Action**. Applications using the **Pages Router** or without **Server Actions** are not vulnerable to this specific issue. Hosting environments may also impact exposure. For instance, **Netlify** noted limited impact on its platform due to its specific configuration, yet still advised upgrading. ### Recommended Actions Developers are urged to upgrade their **Next.js** installations immediately: * For **Next.js** version 16, upgrade to **16.4.1**. * For **Next.js** version 15, upgrade to **15.5.28**. After upgrading, rebuild and redeploy your applications. While **Next.js 16.4.1** automatically bundles the fixed `sharp` version 0.35.5, users on version 15.5.28 should manually verify their `sharp` version using `npm ls sharp` and update it to 0.35.5 or later if an older version persists. If an immediate **Next.js** upgrade is not feasible, a temporary mitigation for the SVG image flaw is to ensure `sharp` is at version 0.35.5 or later, or to block SVG rendering in `sharp` using `sharp.block({ operation: ["VipsForeignLoadSvg"] })`. As of October 15, the `use cache` and **Server Actions** advisories were not yet linked to **CVEs** and might not be detected by `npm audit` or similar dependency scanners. The image flaw, however, is reported through `sharp`'s advisory. ### A Recurring Image Flaw This marks the third RCE vulnerability related to image processing in **Next.js** since August. Previous incidents involved a bug in **libheif** (affecting AVIF images) and a flaw in `next/og` that allowed attacker-controlled text to manipulate generated SVGs. This latest SVG vulnerability, **CVE-2026-96889**, was publicly disclosed on September 23 and patched in `sharp` on September 27. The researcher, Rafael B. Dias, noted that this bug was also behind the September `next/og` flaw. It's important to note that the **React Server Components** flaw is distinct from **React2Shell**, the critical vulnerability disclosed in December 2025. While both affect similar packages, the current flaw is described as much narrower in scope. There are currently no public reports of these newly patched flaws being actively exploited in the wild.