Next.js updates address critical RCE flaws in cache and SVG paths
Next.js has issued an out-of-band security update that fixes two critical unauthenticated remote-code-execution vulnerabilities and one high-severity denial-of-service vulnerability. Vercel released Next.js 16.4.1 and 15.5.28 on October 14; it rates both RCE issues at CVSS 9.5.
The fixes cover a React Server Components issue linked to use cache, a memory-safety flaw in the librsvg image-rendering library reached through sharp, and a Server Actions denial-of-service condition. Organizations running supported Next.js versions should upgrade, rebuild and redeploy their applications.
Two distinct routes to code execution
The cache-related RCE affects Next.js 16.0.0 through 16.4.0. It is relevant to App Router applications with Cache Components enabled when a use cache function returns more than one typed array. React describes the underlying condition in react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack 19.0.0 through 19.3.0 as arising in extremely rare cases involving multiple typed arrays and an attacker-controlled value.
Although that exposure is narrow, Vercel recommends upgrading all affected version 16 deployments, including applications that do not appear to contain such a function. There is no workaround for this flaw; upgrading to 16.4.1 is the only remediation identified in the advisory.
The SVG-related RCE, CVE-2026-96889 and GHSA-2464-fhr4-w9xw, affects Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. It stems from librsvg, which Next.js uses through its bundled sharp package. The advisory identifies code-execution exposure when attacker-controlled SVG content is passed to sharp on glibc-based Linux.
Next.js does not optimise SVG files by default. The image optimiser processes them only when dangerouslyAllowSVG is enabled. The same library can also render images used by next/og when that feature runs on the Node.js runtime. Version 16.4.1 retains the image optimiser from 16.4.0 but raises bundled sharp to 0.35.5, which includes patched librsvg 2.63.2.
Denial of service and version-specific checks
The third issue, GHSA-p3m5-59mp-jv5r, affects App Router applications with at least one Server Action. Crafted requests can drive a server process to full CPU use, preventing it from serving other requests. Pages Router applications and App Router applications without Server Actions are not affected. The fix is included in 15.5.28 and 16.4.1, and no workaround is available.
For version 16, upgrading to 16.4.1 brings in sharp 0.35.5 because that release requires it. Version 15 requires more care: Next.js 15.5.28 can still accept affected sharp 0.34.x releases, so an upgrade over an existing installation may leave an older dependency in place. Teams should run npm ls sharp and update sharp to 0.35.5 or later where necessary.
If an immediate Next.js upgrade is not possible, the SVG issue has an interim mitigation: use sharp 0.35.5 or later, or disable SVG rendering in sharp with sharp.block({ operation: ["VipsForeignLoadSvg"] }). That measure does not address the cache or Server Actions vulnerabilities.
Why dependency scanning may miss exposure
As of October 15, the advisories for the use cache and Server Actions issues had no CVE identifiers and were not listed in the npm advisory feed used by npm audit. The image-processing flaw can surface through sharp's own advisory. Netlify said its platform does not execute the image-optimiser code path and therefore has limited exposure, while still recommending customers upgrade.
Vercel said there were no public reports of exploitation for any of the three issues as of October 15. The practical business implication is to identify every Next.js 15 and 16 deployment, prioritise App Router workloads using Server Actions, Cache Components or SVG processing, verify the installed sharp version, and complete the rebuild and redeployment rather than relying solely on dependency-scanner alerts.