Next.js: Two Critical Unauthenticated RCEs (Oct 14)

What to do

Upgrade: npm install next@16.4.1 (16.x) or next@15.5.28 (15.x), then rebuild and redeploy.
Confirm the resolved sharp is 0.35.5 or later: npm ls sharp.
If you use React Server Components outside Next.js, upgrade react-server-dom-* to 19.0.9/19.1.10/19.2.9/19.3.1.
If you are stuck on an older Next.js line, force sharp >= 0.35.5 via overrides/resolutions and patch system librsvg.
Rebuild container images so the new node_modules and OS libraries actually ship.

How to check if you are affected or compromised

npm ls next sharp react-server-dom-webpack and check against the fixed versions.
Review /_next/image request logs for unusual SVG sources and worker crashes or restarts around image requests.
Hunt for unexpected child processes or outbound connections from the Node.js server process.

What happened#

On October 14, 2026, Vercel shipped an out-of-band Next.js security update, versions 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). It fixes two critical unauthenticated remote code execution bugs and one high-severity denial of service, all rooted in upstream dependencies. Vercel had pre-announced the release on October 8. Two of the fixes were held back from the September release while upstream projects coordinated.

GHSA-673q-mjm6-r5xr (CVSS 4.0 9.5). In App Router apps that use Cache Components, a use cache function that returns multiple typed arrays can be abused for unauthenticated RCE, per the advisory. The root cause is in React's Flight protocol, tracked as GHSA-xqc2-xf4c-x3h3 in react-server-dom-webpack, -turbopack and -parcel. It affects Next.js 16.0.0 through 16.4.0. There is no workaround, and Vercel says to upgrade "even if your application does not have similar functions."
CVE-2026-96889 / GHSA-2464-fhr4-w9xw (CVSS 4.0 9.5). A memory bug in an upstream library used by the Image Optimization API can lead to RCE when Next.js runs on glibc-based Linux, per the advisory. The CVE record describes a use-after-free in librsvg, triggered by SVG documents with nested XIncludes and duplicate entity declarations. Next.js reaches librsvg through sharp. Affected versions run from 10.0.0 through 15.5.27 and 16.x through 16.4.0. The fix requires sharp 0.35.5 or later.
GHSA-p3m5-59mp-jv5r (High). Crafted requests to App Router apps with at least one Server Action can pin the CPU and stall the process.

Who is affected#

The image-optimizer bug has the widest reach. next/image and the /_next/image endpoint are on by default in almost every self-hosted Next.js app, across a decade of versions. The use cache bug is limited to Next.js 16 apps that opted into Cache Components. Apps built with other frameworks on React Server Components, such as Waku, Parcel or custom setups, need the react-server-dom-* 19.x patch releases.

Do you really need to act?#

Patch this week. This is not React2Shell again. Both RCEs carry the CVSS "attack requirements present" flag. The cache bug needs a specific return shape that React calls "rare." The image bug needs glibc Linux and an SVG the optimizer will process. Neither advisory reports exploitation or a public exploit, and neither is in CISA KEV. Still, the December 2025 React2Shell bug went from patch to mass exploitation within hours, and attackers now diff React and Next.js releases closely. The upgrade is a patch-level bump on the same minor line, so there is little reason to wait.

Vercel-hosted apps: the advisories do not say these are protected automatically. Redeploy on the fixed version anyway.
Alpine/musl images: the advisory names glibc as the condition for the image RCE. Upgrade for the other issues regardless.
Older lines (14.x and earlier): no patched Next.js release is listed. Force a fixed sharp and plan a migration.

What to do now#

Upgrade: npm install next@16.4.1 or npm install next@15.5.28 (or the pnpm/yarn equivalent). Commit the lockfile.
Verify the tree with npm ls next sharp react-server-dom-webpack. sharp must be 0.35.5 or later.
On older Next.js lines, add an overrides (npm) or resolutions (yarn) entry for "sharp": "^0.35.5", and update the OS librsvg package where distros ship fixes.
Rebuild and redeploy containers. A patched lockfile in Git does not patch a running image.
If you can't deploy quickly, consider rejecting SVG sources at /_next/image with a WAF or reverse-proxy rule as a stopgap. This is our suggestion, not vendor guidance.

How to tell if you were hit#

No exploitation has been reported. To check anyway:

Look for crashes or restarts of the Next.js server that line up with /_next/image requests for SVGs.
Look for unexpected child processes (sh, curl) spawned by node, and for new outbound connections from app servers.
If anything looks wrong, rotate the secrets in the server's environment, such as database URLs and API keys.

Timeline#

Sep 23, 2026 — CVE-2026-96889 (librsvg) is published.
Sep 30, 2026 — The Next.js September security release ships. Two fixes are postponed for upstream coordination.
Oct 8, 2026 — Vercel pre-announces an out-of-band update with two critical issues and one high.
Oct 14, 2026 — Next.js 16.4.1 and 15.5.28 and the React 19.x patches are released, with advisories published.

Vulnerability records

CVE-2026-96889 · A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.