Next.js · Disclosed

Next.js patches two critical unauthenticated RCEs; upgrade now

Oct 13, 2026 · 1 min read

On October 14, 2026, Vercel released Next.js 15.5.28 and 16.4.1, fixing two critical unauthenticated remote code execution flaws: one in the Image Optimization API with SVG files (CVE-2026-96889, rooted in an upstream library used by sharp) and one in use cache functions returning multiple typed arrays. Upgrade now: sharp 0.35.5 or later mitigates the image flaw; Vercel says there is no workaround for use cache. Sources report no active exploitation.

By HIFY Radar newsroom Updated 10/26/2026 01:29 PM Get this every day →← Back to the feed 5 sources

CriticalVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

On October 14, 2026, Vercel published an out-of-band security update for Next.js, postponed from the September release due to upstream dependency delays. It fixes two critical unauthenticated remote code execution flaws: image optimization processing SVG files and use cache functions returning multiple typed arrays. It also fixes a denial of service flaw in Server Actions.

Why it matters

A remote attacker, with no login, can run code on the application server, with high impact on confidentiality, integrity and availability; the image flaw scores CVSS 9.5. It affects any company running Next.js from version 10 through 16.4.0 on glibc-based Linux, exposed to the internet. Vercel states there is no known workaround for the use cache flaw.

What to do

Upgrade immediately to next 16.4.1 or next 15.5.28 (npm install next@16.4.1 or next@15.5.28) and ensure sharp 0.35.5 or later. Inventory every Next.js application, including those using App Router with Server Actions. Prioritize glibc-based Linux servers optimizing SVG images.

For the technical team

CVE: CVE-2026-96889
Affected: Next.js (pacote next no npm); sharp / librsvg · next >= 10.0.0 and <= 15.5.27; next >= 16.0.0 and <= 16.4.0; sharp < 0.35.5 (bundled a vulnerable librsvg; sharp 0.35.5 ships librsvg 2.63.2, per the GitHub Advisory Database). Conditions: glibc-based Linux and SVG image optimization for flaw 1; App Router with Cache Components for flaw 2; App Router with at least one Server Action for flaw 3.
Exploitation: Sources report no active exploitation, public PoC or KEV listing; advisories published and reviewed only (CVSS v4 9.5 for the image flaw).
Fix: next 15.5.28 and next 16.4.1; sharp 0.35.5 or later (workaround for the image flaw: ensure sharp >= 0.35.5 even without upgrading Next.js; fresh installs already get a fixed sharp). Commands: npm install next@15.5.28 (15.x line) or npm install next@16.4.1 (16.x line). No workaround for use cache: upgrade Next.js.
Vector: Three flaws fixed in the same update. 1) Next.js Image Optimization API when SVG files are used: memory-related flaw in an upstream library (librsvg, a sharp dependency) can lead to RCE when Next.js runs on glibc-based Linux; unauthenticated, network vector, low complexity, no user interaction, CVSS v4 9.5 (CVE-2026-96889, GHSA-2464-fhr4-w9xw). 2) Unauthenticated RCE in applications using App Router with Cache Components when a use cache function returns multiple typed arrays (GHSA-673q-mjm6-r5xr); no known workaround. 3) DoS (high) via crafted requests against App Router with at least one Server Action; excessive CPU usage blocks the process; Pages Router or apps without Server Actions are not vulnerable (GHSA-p3m5-59mp-jv5r).
More details: Advisories: GHSA-2464-fhr4-w9xw (SVG images, CVE-2026-96889), GHSA-673q-mjm6-r5xr (use cache), GHSA-p3m5-59mp-jv5r (DoS); React upstream: GHSA-xqc2-xf4c-x3h3 and GHSA-h3gv-c5rc-p453; sharp: GHSA-wq5f-xc86-pv6w. CWE-1395 (dependency on vulnerable third-party component) in the GitHub record. Found by randomguy6407 and rafabd1; advisory published by eps1lon on Oct 14, 2026; fixes postponed from the September release due to upstream dependency delays; GitHub Advisory Database reviewed Oct 22, 2026. Fix commits cited: vercel/next.js 5e3b687 and 9571ec8.