TL;DR
- Two critical unauthenticated remote code execution vulnerabilities patched in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS)
- First RCE affects App Router applications using Cache Components with use cache functions returning typed arrays; no workaround available
- Second RCE in Image Optimization API occurs when running on glibc-based Linux; can be mitigated by ensuring sharp version 0.35.5 or later
- High-severity denial-of-service vulnerability in App Router Server Actions causes excessive CPU usage under crafted requests
- Active LTS
- v16.4.1
- Maintenance LTS
- v15.5.28
- Critical Issues
- 2 RCE vulnerabilities
What happened
Vercel announced out-of-band security updates for Next.js, releasing patched versions to address vulnerabilities postponed from the September security release due to upstream dependency delays. Developers using Active LTS (v16.4.1) or Maintenance LTS (v15.5.28) can now access fixes for these issues and are advised to upgrade immediately.
npm install next@15.5.28 # for 15.5
npm install next@16.4.1 # for 16.4Critical: RCE in use cache functions with typed arrays
A vulnerability in applications using App Router with Cache Components can trigger unauthenticated remote code execution when a use cache function returns multiple typed arrays. The vulnerability is tracked as GHSA-673q-mjm6-r5xr for Next.js and relates to an upstream issue in React (GHSA-xqc2-xf4c-x3h3). There is no known workaround for affected applications, making immediate upgrade essential even for applications that do not currently use such functions.
Critical: RCE in Image Optimization API with SVG
A memory-related vulnerability exists in an upstream library used for Next.js Image Optimization, tracked as CVE-2026-96889 and GHSA-2464-fhr4-w9xw. The issue leads to remote code execution when Next.js runs on glibc-based Linux systems. As a temporary workaround, applications can ensure their version of sharp is 0.35.5 or later. However, upgrading Next.js to the patched versions (v16.4.1 or v15.5.28) is the recommended approach, as package managers will automatically install the fixed sharp version alongside Next.js.
High-severity denial of service in Server Actions
A high-severity vulnerability in App Router Server Actions (GHSA-p3m5-59mp-jv5r) is related to an upstream React issue (GHSA-h3gv-c5rc-p453). Crafted HTTP requests targeting applications with at least one Server Action can cause excessive CPU usage, blocking further request processing in the same process and resulting in denial of service. Applications using Pages Router or those without Server Actions are not affected by this vulnerability.
Who it affects
The use cache typed array vulnerability impacts any application using App Router with Cache Components and use cache functions. The Image Optimization vulnerability specifically affects deployments on glibc-based Linux systems. The Server Actions denial-of-service issue targets applications using App Router with at least one Server Action defined. Developers on Pages Router without Server Actions are not vulnerable to the DoS issue but should still review the other vulnerabilities based on their feature usage.
Security program and reporting
Vercel manages security for Next.js and other open-source frameworks through the Open Source Bug Bounty program. Researchers interested in contributing to the security of eligible frameworks are encouraged to participate. Questions or concerns regarding security programs or vulnerability management can be directed to security@vercel.com.
Source
Next.js Bloghttps://nextjs.org/blog/nextjs-security-update-october-14-2026AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.
- #next.js
- #security
- #remotecodeexecution
- #patchrelease
- #webdev
