Next.js has released an out of band security update addressing two critical remote code execution vulnerabilities and a high severity denial of service issue affecting certain application configurations. The update, released on October 14, includes fixes for security weaknesses linked to React Server Components, caching functionality and SVG image processing through the sharp package. The vulnerabilities could allow unauthorised remote code execution in specific scenarios, making timely updates important for developers and organisations using affected Next.js versions. The fixes have been included in Next.js 16.4.1 and 15.5.28, which represent the current Active and Maintenance long term support releases.
The first critical vulnerability is related to the use cache functionality within React Server Components. Rated with a CVSS score of 9.5, the issue affects Next.js versions 16.0.0 through 16.4.0 when applications use App Router with Cache Components enabled and a use cache function returns more than one typed array. React’s own security advisory highlighted that the underlying issue affects specific packages, including react server dom webpack, react server dom parcel and react server dom turbopack, in versions 19.0.0 through 19.3.0. While the affected condition is considered limited, Vercel has recommended that users upgrade to the latest patched versions even if their applications do not currently use the specific function associated with the vulnerability. Another critical issue addressed in the update involves SVG image processing through librsvg, an open source library used by Next.js through the bundled sharp package. Identified as CVE 2026 96889, the vulnerability can potentially lead to remote code execution when applications process attacker supplied SVG files on glibc based Linux systems. By default, Next.js does not optimise SVG files, but applications that enable the dangerouslyAllowSVG configuration option may be exposed. The same processing capability is also used by the next/og feature that generates social preview images when operating through the Node.js runtime. The vulnerability was linked to a memory related issue in librsvg, with fixes incorporated into newer versions of sharp.
The security update also resolves a high severity denial of service vulnerability affecting applications using Server Actions. In affected App Router applications with at least one Server Action configured, specially crafted requests could consume significant CPU resources on a server process and prevent it from handling additional requests. Applications using the Pages Router or those without Server Actions are not affected by this issue. Exposure may also vary depending on hosting environments, with some providers noting that their infrastructure does not use certain affected image optimisation paths while still recommending users apply the security updates. Vercel has advised developers to upgrade to Next.js 16.4.1 for version 16 deployments or 15.5.28 for version 15 deployments, followed by rebuilding and redeploying applications. Developers using Next.js 15 are also advised to verify their sharp package version, as some installations may continue using older affected versions. Users can check installed versions through package management tools and update sharp to version 0.35.5 or later where required. If immediate Next.js upgrades are not possible, limited mitigation options are available for the SVG related issue, including updating sharp or disabling SVG rendering operations. However, no workaround is available for the use cache and Server Actions vulnerabilities, making the official update the recommended solution.
The latest fixes also highlight continued security attention around image processing components used within modern web frameworks. Previous security issues involving image handling libraries and Next.js features have shown that third party dependencies can introduce risks when processing user supplied content. In this case, Next.js did not modify its image optimisation code directly but updated the bundled sharp dependency to include a patched librsvg version. As of October 15, there were no public reports confirming exploitation of the three vulnerabilities addressed in the update. The issues demonstrate the importance of regular dependency management, security monitoring and timely patching for organisations operating web applications built on widely used development frameworks.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
