Next.js 16.4.1 and 15.5.28 fix two 9.5-rated code-execution flaws in caching and SVG rendering
Next.js released versions 16.4.1 and 15.5.28 on October 14 to fix two unauthenticated code-execution flaws that Vercel rated CVSS 9.5. As of October 15 the caching flaw had no CVE and no workaround, so npm audit may stay quiet and only the upgrade closes it.
The Watch · Security desk
Timeline: the librsvg bug CVE-2026-96889 was made public on September 23 and fixed in sharp on September 27. Next.js released its out-of-band security update on October 14. As of October 15, the use cache and Server Actions advisories had no CVE.
| Date | Event | Claim |
|---|---|---|
| September 23, 2026 | librsvg bug CVE-2026-96889 made public | 21 |
| September 27, 2026 | librsvg bug fixed in sharp | 21 |
| October 14, 2026 | Next.js releases out-of-band security update | 1 |
| October 15, 2026 | Use cache and Server Actions advisories have no CVE | 17 |
What happened
- The caching flaw needs a use cache function to return several typed arrays. Exposure is limited to version 16 apps that have Cache Components turned on.
- The second flaw is a memory bug in librsvg, reached through the bundled sharp package, and code execution is possible on glibc-based Linux, according to the advisory.
- Next.js does not optimize SVG by default, but setting dangerouslyAllowSVG turns it on, and next/og renders through the same library on the Node.js runtime.
- A third, high-severity flaw is a denial of service: in App Router apps with a Server Action, crafted requests can pin one process at full CPU. Pages Router apps are not affected.
Why it matters
- What doesn't add up contradiction Red Hat scores the librsvg bug 7.8 and says it needs a user to open a malicious file. Vercel scores the Next.js exposure 9.5 and network reachable. The number depends on which layer you read.
- Who has to decide decision Version 15 teams cannot assume the upgrade fixes sharp. 15.5.28 still accepts the older 0.34.x line, so running npm ls sharp is part of the patch.
- Who's exposed exposure Hosting changes the exposure. Netlify says its platform does not run the image-optimizer code path and sees limited impact, so teams on other hosts need to confirm what their platform runs.
- What it sets up precedent Three code-execution flaws in the image path since August put the sharp version on the checklist for every Next.js release.
The caching flaw is the narrow one. React's advisory lists three affected packages, react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, from version 19.0.0 up to 19.3.0 [4]. In the advisory's words, the flaw hits only "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value" [5]. Vercel still says to upgrade even if your app has no such function [7].
The SVG flaw is the one with a stopgap. The sharp advisory describes two: run sharp 0.35.5 or later, or block SVG loading with `sharp.block({ operation: ["VipsForeignLoadSvg"] })` [15]. CVE-2026-96889, the librsvg bug, was disclosed on September 23, and sharp's fix followed on September 27 [21]. Next.js shipped on October 14, which is 21 days after disclosure and 17 days after the sharp fix [24][25]. The report does not say whether either code-execution flaw is being exploited.
The earlier two image-path flaws came through the same stack. In August, a libheif bug reached through sharp allowed code execution when the optimizer handled a crafted AVIF image, and in September a next/og flaw let attacker-controlled text change the SVG it generated [19]. Rafael B. Dias, who reported the librsvg bug, says it is the weakness behind the September flaw [23].
The image code in Next.js itself is unchanged this time: the optimizer in 16.4.1 is identical to the one in 16.4.0, and the release raises sharp to 0.35.5, which carries librsvg 2.63.2 [20]. That makes the fix a dependency bump, and the dependency is where the last three bugs lived.
Those two versions are the current Active and Maintenance LTS releases [2]. Upgrade version 16 apps to 16.4.1 and version 15 apps to 15.5.28, then rebuild and redeploy [12]. On version 16 the upgrade also supplies the fixed sharp, because 16.4.1 requires 0.35.5 [13].
What to watch
- Whether CVE IDs are assigned to the use cache and Server Actions advisories and the npm advisory feed picks them up, so npm audit starts flagging them.
- Whether a later Next.js 15.x release raises its sharp floor to 0.35.5 so the upgrade stops leaving 0.34.x in place.
- Any report of in-the-wild exploitation of either code-execution flaw.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.
- [2]
The fixes are in Next.js 16.4.1 and 15.5.28, the current Active and Maintenance long-term support (LTS) releases.
- [3]
Vercel, which develops Next.js, rated both code-execution flaws critical, each with a CVSS score of 9.5.
- [4]
React's advisory covers three packages, react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack, in versions 19.0.0 through 19.3.0.
- [5]
React's advisory describes the flaw as affecting "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value."
- [6]
In a Next.js app, the trigger is a use cache function that returns more than one typed array, so only version 16 apps that enable Cache Components, the feature behind use cache, are exposed.
- [7]
Vercel says to upgrade even if your app has no such use cache function.
- [8]
The second flaw is a memory bug in librsvg, which Next.js reaches through the bundled sharp package. Code execution is possible when Next.js runs on glibc-based Linux, according to the advisory.
- [9]
By default, Next.js does not optimize SVG files; serving them through the image optimizer requires turning on dangerouslyAllowSVG. The same library also renders images for next/og when that feature runs on the Node.js runtime.
- [10]
In App Router apps that define at least one Server Action, crafted requests can push one server process to full CPU use and stop it from handling other requests. Apps on the Pages Router, or with no Server Actions, are not affected.
- [11]
Netlify said its platform does not run the image-optimizer code path and that the flaws have limited impact on its setup, while still recommending the upgrade.
- [12]
Upgrade to Next.js 16.4.1 if you run version 16, or 15.5.28 if you run version 15, then rebuild and redeploy.
- [13]
On version 16, upgrading Next.js supplies the fixed sharp automatically, because 16.4.1 requires sharp 0.35.5.
- [14]
On version 15, 15.5.28 still accepts the older, affected sharp 0.34.x, and upgrading over an existing install can leave that version in place. Check with npm ls sharp and update sharp to 0.35.5 or later if it is older.
- [15]
If you cannot upgrade Next.js right away, the image flaw has an interim option: make sure sharp is 0.35.5 or later, or block SVG rendering in sharp with sharp.block({ operation: ["VipsForeignLoadSvg"] }), as the sharp advisory describes.
- [16]
The use cache and Server Actions flaws have no workaround, and only the upgrade closes them.
- [17]
As of October 15, the use cache and Server Actions advisories had no CVE and did not appear in the npm advisory feed that npm audit uses, so dependency scanners may not warn about them. The image flaw does surface, through sharp's own advisory.
- [18]
This is the third time since August that image processing in Next.js has produced a code-execution flaw.
- [19]
In August, a bug in libheif, reached through sharp, allowed code execution when the optimizer handled a crafted AVIF image. In September, a flaw in next/og let attacker-controlled text change the SVG it generated.
- [20]
Next.js did not change its own image code this time. 16.4.1 ships the same optimizer as 16.4.0 and fixes the image flaw by raising the bundled sharp to 0.35.5, which carries a patched librsvg (2.63.2).
- [21]
The librsvg bug, CVE-2026-96889, was made public on September 23 and fixed in sharp on September 27.
- [22]
Red Hat scored the librsvg bug 7.8 and said exploiting it needs user interaction, such as opening a malicious file. Vercel rated the Next.js exposure 9.5 and reachable over the network.
- [23]
Rafael B. Dias, the researcher who reported the librsvg bug, says it is the weakness behind September's next/og flaw.
- [24]
The Next.js release came 21 days after the librsvg bug was made public.
- [25]
The Next.js release came 17 days after the librsvg fix landed in sharp.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comNext.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Dependency ScanningFollow
- Web Framework SecurityFollow
- Remote Code Execution SurfacesFollow