Two critical, unauthenticated remote-code-execution flaws in Next.js were patched in an out-of-band update on October 14 — and Vercel rated each code-execution bug a 9.5 on the CVSS scale.
What Vercel changed on October 14
Vercel released security fixes in Next.js 16.4.1 (Active) and 15.5.28 (Maintenance LTS) that close three separate issues: two critical remote-code-execution (RCE) flaws and one high-severity denial-of-service (DoS) bug. The RCE issues affect React Server Components and librsvg (the SVG-rendering library Next.js uses via the sharp package). Vercel’s advisory assigns a 9.5 CVSS score to each code-execution flaw.
How applications become exposed
The first RCE stems from React Server Components. React’s advisory says the flaw affects three packages — react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack — in versions 19.0.0 through 19.3.0, and that it concerns “extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.” Within Next.js, the trigger is a use cache function that returns more than one typed array, which means only Next.js 16 apps that enable Cache Components (the feature behind use cache) are exposed. Vercel advises upgrading even if an app has no such function.
The second RCE is a memory-bug in librsvg (CVE-2026-96889) surfaced through the bundled sharp package. Exploitation is possible when Next.js runs on glibc-based Linux, and the same librsvg renderer also handles images for next/og when that feature runs on the Node.js runtime. By default Next.js does not optimize SVG files; serving SVGs through the image optimizer requires enabling dangerouslyAllowSVG.
The third issue is a DoS: in App Router apps that define at least one Server Action, crafted requests can consume a server process’s CPU and prevent it from handling other requests. Apps on the Pages Router or apps without Server Actions are not affected. Exposure can vary by host: Netlify said its platform does not run the image-optimizer code path and that the flaws have limited impact on its setup, while still recommending the upgrade.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadRemediation steps and short-term mitigations
Vercel’s clear instruction is to upgrade to Next.js 16.4.1 (for version 16) or 15.5.28 (for version 15), then rebuild and redeploy. Upgrading Next.js will cause package managers to supply the fixed sharp automatically on version 16 because 16.4.1 requires sharp 0.35.5.
On version 15, 15.5.28 still accepts sharp 0.34.x and upgrading over an existing install can leave the older, affected sharp in place. Operators should run npm ls sharp and update sharp to 0.35.5 or later if it is older.
If an immediate Next.js upgrade is not possible, there is an interim option for the image flaw: ensure sharp is 0.35.5 or later, or block SVG rendering in sharp with sharp.block({{ operation: ["VipsForeignLoadSvg"] }}), as sharp’s advisory describes. There are no workarounds for the use cache and Server Actions flaws; only the Next.js upgrade closes them.
As of October 15, the use cache and Server Actions advisories had no CVEs and did not appear in the npm advisory feed that npm audit uses, so dependency scanners may not alert teams to those two issues. The image flaw does appear via sharp’s own advisory.
Why image-processing flaws keep resurfacing
This is the third image-processing RCE tied to Next.js’s optimizer since August. In August, a libheif bug reached through sharp allowed code execution when a crafted AVIF image was processed. In September, a next/og flaw allowed attacker-controlled text to change the SVG next/og generated. Next.js did not change its own optimizer code for this October fix; 16.4.1 ships the same optimizer as 16.4.0 and remediates the image issue by upgrading the bundled sharp to 0.35.5, which carries a patched librsvg (2.63.2).
The librsvg bug (CVE-2026-96889) was made public on September 23 and fixed in sharp on September 27. Red Hat scored the librsvg issue 7.8 and said exploiting it requires user interaction such as opening a malicious file; Vercel assessed the Next.js exposure at 9.5 and reachable over the network. The researcher who reported the librsvg bug, Rafael B. Dias, said it is the weakness behind September’s next/og flaw, and a working exploit for that earlier flaw (built for one specific server setup) has since been published. sharp’s maintainer warns that whether the flaw results in code execution or merely a crash can depend on the server’s Node.js build, because the official Node.js binaries are not hardened against this class of memory attack.
What this means for Netlify, app developers, and security teams
- Netlify: The company says its platform does not run the image-optimizer code path, limiting impact there, but it still recommends upgrading deployed Next.js versions.
- App developers using App Router and Server Actions: Must treat the DoS bug as material — Server Actions are a required condition for that exposure — and plan to upgrade and redeploy to fully close it.
- Security teams and build operators: Should check installed sharp versions (npm ls sharp), ensure sharp is 0.35.5 or later when a full Next.js upgrade is delayed, and be aware that the use cache and Server Actions issues may not yet be visible to npm audit as of October 15.
As of October 15, there were no public reports that any of the October 14 fixes had been used in attacks. The immediate step for teams running Next.js 15 or 16 is unambiguous: upgrade to 15.5.28 or 16.4.1, rebuild, redeploy, and verify sharp is at least 0.35.5.
