Next.js fixes two critical remote code execution flaws and a denial-of-service bug

Next.js has shipped an urgent update fixing two critical remote code execution flaws (CVSS 9.5) and a denial-of-service bug. It affects websites, online shops and customer portals built with the framework. Ask your team or vendor today to upgrade to 16.4.1 or 15.5.28 and redeploy the application.

Key facts

• Next.js released an out-of-band update on 14 October. Spain's INCIBE-CERT picked it up on 16 October with importance 5 (critical): 3 vulnerabilities, 2 critical and 1 high.
• Vercel rated both code execution flaws CVSS 9.5, according to The Hacker News.
• CVE-2026-96889 (SVG images) affects versions 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0.
• GHSA-673q-mjm6-r5xr (use cache) affects versions 16.0.0 to 16.4.0. GHSA-p3m5-59mp-jv5r (Server Actions, denial of service) affects 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0.
• Fixed versions: 16.4.1 and 15.5.28 (the latter with sharp 0.35.5 or later). As of 15 October there were no public reports of attacks.

Am I affected if an agency built my website?

Yes, if it's built with Next.js. It doesn't matter who wrote the code: what counts is the version running on the server. This covers corporate websites, online shops, customer portals and SaaS products.

Not every flaw applies to every app:

• use cache: only if you use App Router with Cache Components enabled and a use cache function that returns more than one typed array. Branch 16 only.
• SVG: only if the app passes attacker-controlled SVGs to sharp on glibc-based Linux. By default Next.js doesn't optimise SVGs; the dangerouslyAllowSVG setting must have been enabled.
• Server Actions: the widest reach, going back to version 13.0.0.

You don't need to know whether your app meets those conditions. Your vendor does. The useful question isn't "are we exposed?" but "which version are we on and when are you upgrading?".

Why hasn't any alert gone off?

Because two of the three flaws had no CVE as of 15 October. The use cache and Server Actions advisories also didn't appear in the npm feed that npm audit uses, according to The Hacker News. If your team relies on its dependency scanner to catch these things, it may not have been warned this time.

Is upgrading Next.js enough?

Almost. There's a catch on branch 15: 15.5.28 still accepts sharp 0.34.x, which is vulnerable. Upgrading over an existing install can leave sharp on that version. Check it with npm ls sharp and move to 0.35.5 or later if needed.

Also, upgrading the package protects nothing until the application is rebuilt and redeployed.

What to do today

1. Write to whoever maintains your website or product and ask whether it uses Next.js and which version.
2. If it's on branch 16, upgrade to 16.4.1. If it's on 15, upgrade to 15.5.28.
3. On branch 15, ask them to run npm ls sharp and confirm sharp is 0.35.5 or later.
4. Insist they rebuild and redeploy, and confirm the production version in writing.
5. If they can't upgrade today: for the SVG flaw, move sharp to 0.35.5 or later, or block SVG rendering in sharp. The other two flaws have no workaround; only the upgrade closes them.

What it means for a small business

There are no known attacks. That's a window, not a reason to wait. A CVSS 9.5 remote code execution flaw on the server behind your shop or customer portal is exactly the kind of hole personal data leaks through. If that happens, you're no longer talking about a patch: you're managing a breach and assessing whether to notify it under the GDPR. Upgrading today costs far less.

There's a deeper point. This is the third time since August that image processing in Next.js has produced a code execution flaw. And two of these advisories didn't show up in automated tools. If your website depends on an outside vendor, the contract should say who watches these advisories and how quickly upgrades happen. If nobody owns that task, in practice nobody does it. If you want help sorting it out, see our cybersecurity service.

Frequently asked questions

Are these flaws being exploited already?

As of 15 October there were no public reports of attacks on any of the three. Now that the details are public, it's best not to push that window.

Does avoiding SVG images protect me?

Only against CVE-2026-96889. The use cache and Server Actions flaws don't depend on images and are only closed by upgrading.

Which version is safe?

16.4.1 on branch 16, or 15.5.28 on branch 15 with sharp 0.35.5 or later.

Sources

• INCIBE-CERT – Avisos (alerta temprana)
• The Hacker News – Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing