Next.js Patches Two Critical Remote Code Execution Flaws and a High-Severity DoS Vulnerability

The Next.js team has published an out-of-band security update addressing three vulnerabilities affecting applications that use specific framework features and upstream dependencies. The October 14, 2026, announcement covers two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service (DoS) vulnerability.

The release provides patched versions for the Active Long-Term Support (LTS) and Maintenance LTS branches. Developers are advised to update their Next.js dependencies to maintain application security.

According to the official announcement, the fixes are available in Next.js 16.4.1 and 15.5.28. Two fixes had been postponed from the September security release because of delays involving upstream dependencies.

The update is particularly relevant for teams using App Router, Cache Components, Server Actions, and the Image Optimization API. However, exposure depends on the affected functionality and, in some cases, the underlying operating system.

Three Vulnerabilities Addressed in the October Update

The security announcement identifies three separate issues. Each affects a different part of the framework and carries a different risk.

1. Critical RCE Vulnerability in Cache Components

The first critical vulnerability affects applications using the App Router with Cache Components. The issue occurs when a use cache function returns multiple typed arrays under the conditions described in the security advisory.

The vulnerability can allow unauthenticated remote code execution. This means an attacker may be able to trigger code execution without first logging in, potentially compromising the affected application server.

Next.js identifies the issue as GHSA-673q-mjm6-r5xr and links it to the upstream React advisory GHSA-xqc2-xf4c-x3h3.

Important: The announcement states that there is no known workaround for affected applications. Developers should upgrade immediately, even if they do not believe their applications contain similar cache functions

2. Critical RCE Vulnerability in the Image Optimization API

The second critical vulnerability affects Next.js Image Optimization when SVG files are processed through an upstream library on Linux systems using glibc.

Tracked as CVE-2026-96889 and GHSA-2464-fhr4-w9xw, the issue involves a memory-related vulnerability in an upstream library used by the Image Optimization API. Under the affected conditions, this flaw can lead to remote code execution.

The announcement provides a workaround for teams that cannot immediately upgrade: ensure the version of sharp used by Next.js is 0.35.5 or later.

However, the recommended long-term response is to upgrade Next.js to a patched release. The official announcement states that upgrading allows package managers to provide a fixed version of sharp to Next.js.

Developers should verify the dependency version actually used by their deployment rather than assuming that changing a version declaration alone resolves the issue.

3. High-Severity DoS Vulnerability in Server Actions

The third vulnerability concerns denial of service in applications using the App Router with at least one Server Action.

According to Next.js, specially crafted requests targeting these endpoints can trigger excessive CPU usage. This can block the application process from handling additional requests, disrupting service availability.

The issue is tracked as GHSA-p3m5-59mp-jv5r and is associated with the upstream React advisory GHSA-h3gv-c5rc-p453.

The announcement clarifies that applications using the Pages Router, or applications that do not use Server Actions, are not vulnerable to this particular issue.

For affected deployments, the main priority is to apply the relevant security update and verify that the application is running the patched dependency.

Which Next.js Versions Should Developers Install?

The official security announcement identifies two patched Next.js releases:

Developers can apply the update using the commands provided in the announcement:

npm install next@15.5.28

Or, for the 16.4 release branch:

npm install next@16.4.1

Choose the command that matches your application's supported release branch. Before deploying, review your package manager's lockfile, check dependency resolution, run relevant tests, and confirm the deployed build uses the intended version.

The announcement does not provide a complete version-by-version compatibility matrix for every older Next.js release in the article itself. Teams running older branches should consult the official security advisory and support policy before deciding on an upgrade path.

What Developers Should Do Now

Developers and security teams should prioritise the following actions:

1. Identify affected applications. Check which Next.js versions are installed and whether deployments use App Router, Cache Components, Server Actions, or the Image Optimization API.
   
   

2. Upgrade to a patched release. Move supported applications to Next.js 16.4.1 or 15.5.28, as appropriate.
   
   

3. Check the sharp dependency. For the SVG-related vulnerability, verify that the version used by Next.js is 0.35.5 or later if relying on the announced workaround. This does not replace the recommended framework upgrade.
   
   

4. Test and redeploy. Run appropriate application tests and confirm that the production deployment contains the patched dependencies.
   
   

5. Review upstream React advisories. Applications that directly manage React Server Components packages should also review the linked React security guidance.
   
   

6. Document remediation. Record the affected applications, installed versions, upgrade status, and any remaining issues for internal security tracking.

These steps are practical remediation recommendations based on the issues described in the official announcement. They are not a claim that the update automatically resolves unrelated vulnerabilities or application-specific security weaknesses.

Why This Update Matters for Development Teams

This release highlights how security issues in upstream dependencies can affect frameworks used to build and operate web applications.

Next.js relies on a broader software ecosystem, including React Server Components and image-processing libraries. A vulnerability in one of these components can create risks for applications that integrate it, even when the application code itself has not changed.

For development teams, this reinforces the importance of dependency management, security advisories, and regular patching. It also shows why security updates should be treated as part of routine maintenance rather than postponed until the next planned feature release.

The announcement does not disclose specific customer incidents or confirmed exploitation of these three vulnerabilities. Additional details were not disclosed in the announcement.

Conclusion

The October 14, 2026, Next.js security update addresses two critical remote code execution vulnerabilities and one high-severity denial-of-service issue. The affected components include Cache Components, the Image Optimization API, and Server Actions.

Developers should review their applications, identify relevant exposure, and upgrade to the appropriate patched release. For the SVG processing issue, the announced sharp workaround may help reduce risk while an upgrade is being prepared. For the Cache Components issue, Next.js explicitly states that no known workaround is available.