Next.js Patches Two Critical Unauthenticated RCE Flaws

Vercel on Wednesday released an out-of-band Next.js security update that fixes two critical unauthenticated remote code execution vulnerabilities and a high-severity denial-of-service flaw.

The fixes ship in Next.js 16.4.1 and 15.5.28, the framework’s Active and Maintenance long-term support releases. Both code-execution bugs carry a CVSS v4 score of 9.5. One is tracked as CVE-2026-96889; the other has no CVE ID yet. Two of the fixes were held back from the September security release because of delays in upstream dependencies, the Next.js team said.

The first flaw sits in React Server Components, the React feature that renders interface components on the server. Crafted payloads can trigger code execution when a server response carries multiple typed arrays, which are fixed-length binary buffers such as Uint8Array, together with an attacker-controlled value.

In Next.js, that path opens when an App Router application with Cache Components enabled has a use cache function returning more than one typed array, so only Next.js 16.0.0 through 16.4.0 is affected. React patched the underlying bug in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.9, 19.1.10, 19.2.9, 19.3.1, and describes the triggering conditions as extremely rare.

Vercel lists no workaround. Developers should “upgrade immediately even if your application does not have similar functions,” the company said.

The second flaw, CVE-2026-96889, is a memory bug in librsvg, the SVG rendering library Next.js reaches through the bundled sharp image-processing package. An attacker-supplied SVG handled by the Image Optimization API can lead to code execution when Next.js runs on glibc-based Linux. It affects versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0.

Default deployments are less exposed than the score suggests. Next.js does not optimize SVG files unless developers enable the dangerouslyAllowSVG setting, although the same library also renders social-preview images for next/og on the Node.js runtime.

Vendors disagree on the librsvg bug’s severity. Red Hat rated it 7.8 and said exploitation needs user interaction, such as opening a malicious file, while Vercel scored the Next.js exposure 9.5 and reachable over the network with no user involvement. The fix arrived in sharp 0.35.5, which bundles librsvg 2.63.2.

It is the third code-execution flaw in Next.js image handling since August, following a libheif bug triggered by crafted AVIF images and a September next/og flaw. Researcher Rafael B. Dias, who reported the librsvg bug, says it is the weakness behind the September issue, for which a working exploit has since been published.

The denial-of-service flaw, GHSA-p3m5-59mp-jv5r, scores 8.2. Crafted requests sent to an App Router application with at least one Server Action drive CPU usage high enough that the process stops handling other requests. Versions 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0 are affected, while Pages Router apps and apps without Server Actions are not.

The React Server Components bug lives in the same packages as React2Shell, the maximum-severity flaw disclosed in December 2025 that attackers exploited at scale, but its trigger is far narrower. As of October 15, there were no public reports of any of the three new flaws being exploited.

Administrators should run npm install [email protected] on the 16.x line or npm install [email protected] on 15.x, then rebuild and redeploy. Version 16.4.1 requires the patched sharp, but 15.5.28 still accepts the vulnerable sharp 0.34.x, so 15.x users should confirm the installed version with npm ls sharp and move to 0.35.5 or later.

Teams that cannot upgrade right away can close the SVG path by updating sharp alone or by blocking SVG decoding with sharp.block({ operation: ["VipsForeignLoadSvg"] }). The use cache and Server Actions bugs have no workaround, and because neither had a CVE or an entry in the npm advisory feed as of October 15, npm audit and similar dependency scanners may not flag them. Netlify said its platform does not run the image-optimizer code path but still recommends upgrading.