Next.js has patched three security vulnerabilities—two rated critical and one high—that can allow attackers to remotely execute code or disrupt service, even without authentication. The affected areas span cache-configured components, SVG handling in the Image API, and Server Actions. Fixes are bundled in Next.js versions 16.4.1 and 15.5.28. Advisories went live on October 14, 2026.
What’s Broken
The most severe flaw (GHSA-673q-mjm6-r5xr) affects applications using the App Router and Cache Components. If the application’s use cache function returns multiple typed arrays, remote attackers may trigger code execution without any user interaction. This vulnerability invades Next.js versions 16.0.0 through 16.4.0. The only remedy is upgrading to 16.4.1.
The second critical vulnerability, CVE-2026-96889, hinges on how SVG images are processed via the Image Optimization API. In Linux systems using glibc, attackers can exploit memory errors to run code remotely. The flaw is present in Next.js versions 10.0.0-15.5.27 and 16.0.0-16.4.0. The advised mitigation is updating the sharp library to version 0.35.5 or moving to a patched Next.js release.
Denial-of-Service and What Else
The third issue, GHSA-p3m5-59mp-jv5r, is a high-severity denial-of-service bug tied to Server Actions with the App Router. Crafted requests can overload CPU usage, rendering the process unable to serve further traffic. Pages Router setups or apps that don’t use Server Actions are not at risk. Affected builds include Next.js 13.0.0-15.5.27 and 16.0.0-16.4.0.
Developers are urged to upgrade: applications on versions below 15.5.28 or 16.4.1 are vulnerable. Only updates address every flaw; merely upgrading sharp covers only the Image API issue.
Exposure also depends on which Next.js features are enabled. Some features—like the use cache function, SVG support in Image Optimization, or Server Actions—must be active for the vulnerabilities to matter. Just using an older version doesn’t guarantee compromise.
Why this matters: these vulnerabilities carry high exploit potential. The two remote code execution flaws carry a 9.5 severity score, while the denial-of-service weakness is rated 8.2. That makes them among the most serious issues in recent Next.js security history.
What to Watch
• Audit your Next.js configuration—if you use App Router with cache components, SVGs, or Server Actions, assume you’re vulnerable.
• Upgrade your platform: aim for version 15.5.28 or 16.4.1 depending on your release branch.
• Verify sharp is at least version 0.35.5 if you’re leveraging Next.js’ image optimization.
• Avoid relying on partial updates—only full version fixes ensure protection across all revealed flaws.
These vulnerabilities underscore a broader trend: as web frameworks gain complexity—handling server side rendering, image pipelines, and new router paradigms—attack surface grows. The fact that attackers can chain flaws tied to features many developers take for granted (cache, SVG, server actions) means defensive posture must evolve just as fast. Teams should prioritize settings audits and version discipline going forward to avoid being blindsided.
