Next.js 16.4.1 Patches Critical Remote Code Execution Vulnerabilities

What Happened

Vercel released Next.js 16.4.1 on October 14, 2026, a security-focused patch containing fixes for multiple vulnerabilities. The release specifically addresses three high-priority security advisories: two critical unauthenticated remote code execution flaws and one high-severity denial of service vulnerability. This is a targeted security update designed to remediate active threats without introducing breaking changes or new features.

Critical Vulnerabilities Fixed

The first critical vulnerability (GHSA-673q-mjm6-r5xr) affects use cache functions when they return typed arrays. This flaw allows unauthenticated attackers to execute arbitrary code on affected systems. The second critical vulnerability (GHSA-2464-fhr4-w9xw) targets the Image Optimization API specifically when processing SVG files. This vulnerability also permits unauthenticated remote code execution, potentially compromising applications that rely on Next.js to handle SVG image optimization.

In addition to these critical flaws, Next.js 16.4.1 addresses a high-severity denial of service vulnerability (GHSA-p3m5-59mp-jv5r) in the App Router when Server Actions are used. This vulnerability could be exploited to disrupt service availability for affected applications.

Who Should Update

Any developer or organization running Next.js 16.4.0 or earlier should prioritize upgrading to 16.4.1 immediately. This is especially critical for applications that use use cache functions with typed array returns, implement Image Optimization features with SVG file handling, or rely on Server Actions within the App Router. Because these are unauthenticated remote code execution vulnerabilities, the security impact is particularly severe—no authentication or special configuration is required for an attacker to exploit them.

The vulnerabilities affect production deployments where these features are enabled or configured, regardless of application size or visibility. Self-hosted Next.js deployments, as well as those leveraging Vercel's hosting, should apply the patch.

How to Upgrade

To upgrade to Next.js 16.4.1, update your package.json dependency for next to version 16.4.1, then reinstall dependencies. For npm, run npm install or npm install next@16.4.1. For yarn, run yarn upgrade next@16.4.1. For pnpm users, run pnpm update next@16.4.1. After upgrading, redeploy your application to apply the security fixes in your production environment.

Context and Related Issues

This release follows a series of security advisories issued by the Next.js team in recent weeks. Additional vulnerabilities have been disclosed across various Next.js features, including cache poisoning issues in static generation and incremental static regeneration, server-side request forgery in Image Optimization, and information disclosure in the development server's Model Context Protocol endpoint. Organizations should review the full list of advisories at the Next.js security page to determine if any other vulnerabilities may affect their deployments.

Developers can report additional security vulnerabilities to responsible.disclosure@vercel.com to ensure they are investigated and addressed promptly.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.