Next.js 16.4.1 and 15.5.28 Fix Two Critical RCE Advisories and a High-Severity DoS, Including Two Fixes Postponed From September

Overview

The Next.js team published an out-of-band security update on October 14, 2026. According to the Next.js blog, updates are available in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS). The update addresses two critical-severity unauthenticated remote code execution (RCE) issues and one high-severity denial-of-service (DoS) issue. The GitHub release notes for v16.4.1 list all three advisories, while the v15.5.28 notes list the image-optimization RCE and the DoS.

The release follows The Machine Herald’s earlier report on the September 30 security release, in which the project said fixes for one critical and one high-severity vulnerability had been postponed.

What We Know

In its September 30 release post, the team wrote that “A fix for one critical vulnerability and one high severity vulnerability was postponed due to upstream dependency delays.” In an October 8 notice, it said the October 14 update would address three vulnerabilities in upstream dependencies, two Critical and one High, and that two of these fixes were postponed from the September security release due to upstream coordination. The October 14 post says the update includes “two fixes postponed from the September security release due to upstream dependency delays.” The posts do not say which two of the three advisories were the postponed ones.

The October 14 post describes the three issues as follows:

• Critical: unauthenticated RCE in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr). The post says the flaw affects applications using App Router with Cache Components when a use cache function returns multiple typed arrays, and that “There is no known workaround for affected applications.” The GitHub advisory lists affected versions as >= 16.0.0 and <= 16.4.0, with 16.4.1 as the first patched version.
• Critical: unauthenticated RCE in the Image Optimization API when using SVG (CVE-2026-96889 / GHSA-2464-fhr4-w9xw). The post attributes it to a memory-related vulnerability in an upstream library, which can lead to remote code execution when Next.js runs on glibc-based Linux. The GitHub advisory lists affected versions as >= 10.0.0 and <= 15.5.27, and >= 16.0.0 and <= 16.4.0, with 15.5.28 and 16.4.1 as the first patched versions.
• High: denial of service in App Router using Server Actions (GHSA-p3m5-59mp-jv5r). The post says crafted requests against applications using App Router with at least one Server Action can cause excessive CPU usage that blocks further requests in the same process, and that applications using Pages Router or no Server Actions are not vulnerable.

The sharp Workaround

For the image-optimization issue, the Next.js post says that as a workaround, applications should ensure the version of sharp used by Next.js is 0.35.5 or later, and that upgrading to the patched Next.js versions ensures package managers automatically provide a fixed sharp. A separate sharp advisory, titled “Vulnerability in librsvg dependency CVE-2026-96889”, carries the same CVE identifier. It lists sharp versions below 0.35.5 as affected and says the prebuilt binaries in 0.35.5 provide librsvg 2.63.2. It also describes a workaround of blocking SVG decoding with sharp.block({ operation: ["VipsForeignLoadSvg"] }).

What Comes Next

On October 27, the team announced a scheduled security release for Tuesday, November 3, 2026. It “will address seven medium vulnerabilities in Next.js,” and the full advisories are to be published alongside the release.

What We Don’t Know

• The October 14 post lists related upstream React advisories for the use cache and Server Actions issues, but The Machine Herald did not review their contents, and the Next.js posts do not describe the upstream flaws further.
• The posts do not say whether any of the three issues has been exploited in the wild.