Do Son 
TL;DR
Vercel shipped Next.js 16.4.1 and 15.5.28 on October 14, 2026, in an out-of-band release. The Next.js security update fixes two critical unauthenticated remote code execution flaws and one high-severity denial-of-service bug. Developers should upgrade right away.
- CVE: CVE-2026-96889
- CVSS: 7.8 (High · CVSSv3)
- Product: Red Hat Enterprise Linux 10
- Impact: Librsvg: use-after-free when xml includes have duplicated entities
- Status: No confirmed exploitation yet
- EPSS: 0.2% (30-day)
- Action: See vendor advisory
Why It Matters
Next.js powers a large share of modern React websites. Two of the three bugs need no login, so any public app on an affected version could be at risk. The release also includes two fixes delayed from September while upstream dependencies caught up.
How the Attacks Work
RCE in “use cache” functions (Critical)
Tracked as GHSA-673q-mjm6-r5xr, this flaw affects apps using App Router with Cache Components. Remote code execution becomes possible when a “use cache” function returns multiple typed arrays. The root cause sits in React, under a related upstream advisory.
RCE in Image Optimization via SVG (Critical)
CVE-2026-96889 stems from a memory bug in the upstream sharp image library. It can lead to remote code execution when Next.js runs on glibc-based Linux.
Denial of service in Server Actions (High)
Crafted requests can drive CPU usage high in apps using App Router with Server Actions. That blocks further requests in the same process.
Exploitation status
Vercel does not report exploitation in the wild. No public proof-of-concept has been confirmed either.
Affected Versions
- The “use cache” RCE affects Next.js 16.0.0 through 16.4.0.
- The Server Actions DoS affects 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0.
Patch and Mitigation Steps
- Upgrade to Next.js 16.4.1 or 15.5.28.
- If you cannot upgrade yet, ensure sharp is version 0.35.5 or later to block the SVG flaw.
The Next.js security update announcement warns there is no workaround for the “use cache” flaw. In fact, the team urges teams to “upgrade immediately even if your application does not have similar functions.” This Next.js security update should be a top priority.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
