---
title: "Next.js: Two Critical Unauthenticated RCEs (Oct 14)"
url: https://erroneo.us/security/briefs/nextjs-use-cache-image-optimizer-rce/
description: "Next.js 16.4.1 and 15.5.28 fix unauthenticated RCE in 'use cache' typed arrays and SVG image optimization via sharp/librsvg. Upgrade this week."
type: security-brief
section: "Security Digest"
date_published: 2026-10-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-96889"]
severity: "critical"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Next.js: Two Critical Unauthenticated RCEs (Oct 14)

**Verdict: Patch this week.** Self-hosted Next.js apps should move to 16.4.1 or 15.5.28 this week; both RCEs have preconditions and no exploitation is reported, but the fix is a routine minor upgrade.

- **Who must act:** Teams running self-hosted Next.js on glibc Linux with the built-in Image Optimization API, and any Next.js 16 App Router app using Cache Components.
- **Who can relax:** Static exports with no Next.js server, apps on Alpine/musl without the image optimizer in play, and apps not using 'use cache' still should upgrade but need not drop everything.
- **Affected:** next 16.0.0 through 16.4.0; next 10.0.0 through 15.5.27 (Image Optimization RCE); react-server-dom-webpack/turbopack/parcel 19.0.0-19.0.8, 19.1.0-19.1.9, 19.2.0-19.2.8, 19.3.0; sharp before 0.35.5 (via librsvg CVE-2026-96889)
- **Fixed:** next 16.4.1; next 15.5.28; react-server-dom-* 19.0.9, 19.1.10, 19.2.9, 19.3.1; sharp 0.35.5
- **CVEs:** CVE-2026-96889
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Upgrade: npm install next@16.4.1 (16.x) or next@15.5.28 (15.x), then rebuild and redeploy.
2. Confirm the resolved sharp is 0.35.5 or later: npm ls sharp.
3. If you use React Server Components outside Next.js, upgrade react-server-dom-* to 19.0.9/19.1.10/19.2.9/19.3.1.
4. If you are stuck on an older Next.js line, force sharp >= 0.35.5 via overrides/resolutions and patch system librsvg.
5. Rebuild container images so the new node_modules and OS libraries actually ship.

### How to check if you are affected

- npm ls next sharp react-server-dom-webpack and check against the fixed versions.
- Review /_next/image request logs for unusual SVG sources and worker crashes or restarts around image requests.
- Hunt for unexpected child processes or outbound connections from the Node.js server process.

## What happened

On October 14, 2026, Vercel shipped an out-of-band [Next.js security update](https://nextjs.org/blog/nextjs-security-update-october-14-2026), versions 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). It fixes two critical unauthenticated remote code execution bugs and one high-severity denial of service, all rooted in upstream dependencies. Vercel had [pre-announced the release on October 8](https://nextjs.org/blog/upcoming-nextjs-security-update-october-2026). Two of the fixes were held back from the September release while upstream projects coordinated.

- **GHSA-673q-mjm6-r5xr** (CVSS 4.0 9.5). In App Router apps that use Cache Components, a `use cache` function that returns multiple typed arrays can be abused for unauthenticated RCE, per [the advisory](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr). The root cause is in React's Flight protocol, tracked as [GHSA-xqc2-xf4c-x3h3](https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3) in `react-server-dom-webpack`, `-turbopack` and `-parcel`. It affects Next.js 16.0.0 through 16.4.0. There is no workaround, and Vercel says to upgrade "even if your application does not have similar functions."
- **CVE-2026-96889 / GHSA-2464-fhr4-w9xw** (CVSS 4.0 9.5). A memory bug in an upstream library used by the Image Optimization API can lead to RCE when Next.js runs on glibc-based Linux, per [the advisory](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw). The [CVE record](https://nvd.nist.gov/vuln/detail/CVE-2026-96889) describes a use-after-free in librsvg, triggered by SVG documents with nested XIncludes and duplicate entity declarations. Next.js reaches librsvg through `sharp`. Affected versions run from 10.0.0 through 15.5.27 and 16.x through 16.4.0. The fix requires `sharp` 0.35.5 or later.
- **GHSA-p3m5-59mp-jv5r** (High). Crafted requests to App Router apps with at least one Server Action can pin the CPU and stall the process.

## Who is affected

The image-optimizer bug has the widest reach. `next/image` and the `/_next/image` endpoint are on by default in almost every self-hosted Next.js app, across a decade of versions. The `use cache` bug is limited to Next.js 16 apps that opted into Cache Components. Apps built with other frameworks on React Server Components, such as Waku, Parcel or custom setups, need the `react-server-dom-*` 19.x patch releases.

## Do you really need to act?

**Patch this week. This is not React2Shell again.** Both RCEs carry the CVSS "attack requirements present" flag. The cache bug needs a specific return shape that React calls "rare." The image bug needs glibc Linux and an SVG the optimizer will process. Neither advisory reports exploitation or a public exploit, and neither is in CISA KEV. Still, the December 2025 React2Shell bug went from patch to mass exploitation within hours, and attackers now diff React and Next.js releases closely. The upgrade is a patch-level bump on the same minor line, so there is little reason to wait.

- **Vercel-hosted apps:** the advisories do not say these are protected automatically. Redeploy on the fixed version anyway.
- **Alpine/musl images:** the advisory names glibc as the condition for the image RCE. Upgrade for the other issues regardless.
- **Older lines (14.x and earlier):** no patched Next.js release is listed. Force a fixed `sharp` and plan a migration.

## What to do now

1. Upgrade: `npm install next@16.4.1` or `npm install next@15.5.28` (or the pnpm/yarn equivalent). Commit the lockfile.
2. Verify the tree with `npm ls next sharp react-server-dom-webpack`. `sharp` must be 0.35.5 or later.
3. On older Next.js lines, add an `overrides` (npm) or `resolutions` (yarn) entry for `"sharp": "^0.35.5"`, and update the OS `librsvg` package where distros ship fixes.
4. Rebuild and redeploy containers. A patched lockfile in Git does not patch a running image.
5. If you can't deploy quickly, consider rejecting SVG sources at `/_next/image` with a WAF or reverse-proxy rule as a stopgap. This is our suggestion, not vendor guidance.

## How to tell if you were hit

No exploitation has been reported. To check anyway:

- Look for crashes or restarts of the Next.js server that line up with `/_next/image` requests for SVGs.
- Look for unexpected child processes (`sh`, `curl`) spawned by `node`, and for new outbound connections from app servers.
- If anything looks wrong, rotate the secrets in the server's environment, such as database URLs and API keys.

## Timeline

- Sep 23, 2026 — CVE-2026-96889 (librsvg) is published.
- Sep 30, 2026 — The Next.js September security release ships. Two fixes are postponed for upstream coordination.
- Oct 8, 2026 — Vercel pre-announces an out-of-band update with two critical issues and one high.
- Oct 14, 2026 — Next.js 16.4.1 and 15.5.28 and the React 19.x patches are released, with advisories published.

## Sources

1. [Next.js — Security Update for Upstream Vulnerabilities (Oct 14, 2026)](https://nextjs.org/blog/nextjs-security-update-october-14-2026)
2. [Next.js — Upcoming Next.js Security Update (Oct 8, 2026)](https://nextjs.org/blog/upcoming-nextjs-security-update-october-2026)
3. [Vercel / GitHub — GHSA-673q-mjm6-r5xr: RCE in 'use cache' functions returning typed arrays](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr)
4. [Vercel / GitHub — GHSA-2464-fhr4-w9xw: RCE in Image Optimization API with SVG (CVE-2026-96889)](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw)
5. [React / GitHub — GHSA-xqc2-xf4c-x3h3: RCE in React Server Components](https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3)
6. [NVD — CVE-2026-96889 (librsvg use-after-free)](https://nvd.nist.gov/vuln/detail/CVE-2026-96889)

---
Source page: https://erroneo.us/security/briefs/nextjs-use-cache-image-optimizer-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt