Two critical flaws, one emergency patch
On October 14, 2026, Vercel shipped an out-of-band security update for Next.js that fixes two separate remote code execution flaws, both rated 9.5 out of 10 on the CVSS scale. That’s the kind of score that means an attacker can run their own code on your server without needing a password or an account. If your business website, customer portal, or internal app runs on Next.js, this patch is not optional.
You don’t need to be a developer to understand the exposure. If someone built your web app on Next.js and it sits on a Linux server, there’s a real chance at least one of these flaws applies to you. The fix is an upgrade, and it needs to happen before your developers move on to the next sprint.
What exactly was patched
The first flaw lives in React Server Components, specifically in how Next.js handles a feature called use cache. When a cached function returns more than one typed array and an attacker can influence the response, code execution becomes possible. This affects Next.js versions 16.0.0 through 16.4.0. Vercel says to upgrade even if your app doesn’t use that function, because confirming its absence requires a code audit most teams won’t do under pressure.
The second flaw is in librsvg, the library that renders SVG images. Next.js reaches it through a package called sharp. On glibc-based Linux, which covers the vast majority of cloud and VPS deployments, a crafted SVG file can trigger memory corruption and lead to code execution. This one has a CVE, CVE-2026-96889, and it affects versions as far back as 10.0.0. The librsvg bug was made public on September 23, 2026 and patched in sharp four days later. Next.js picked up the fix by bundling sharp 0.35.5 in the October 14 release.
There’s also a denial-of-service flaw in Server Actions. A crafted request can pin a server process at full CPU, which means legitimate users get no response. It’s lower severity than the other two, but it still needs the same upgrade to close.
This is the third image-processing flaw in Next.js since August 2026. A working exploit for the September flaw, which involved the next/og social preview feature, has already been published publicly. The pattern matters: attackers know where to look.
How to actually fix this
The target versions are 16.4.1 for Next.js 16 and 15.5.28 for Next.js 15. Upgrading and redeploying closes the Server Actions and use cache flaws completely. There is no workaround for those two.
The SVG flaw needs one extra check on version 15. Running npm ls sharp after the upgrade will tell you which version of sharp is installed. If it’s below 0.35.5, update sharp explicitly. Version 15.5.28 still accepts the older sharp 0.34.x, so an in-place upgrade can leave the vulnerable version sitting there quietly.
- Upgrade to Next.js 16.4.1 or 15.5.28, then rebuild and redeploy
- Run npm ls sharp and confirm sharp is 0.35.5 or later
- If you can’t upgrade immediately, block SVG rendering with sharp.block({ operation: [“VipsForeignLoadSvg”] }) as a temporary measure for the image flaw only
One more thing worth flagging: as of October 15, 2026, the use cache and Server Actions advisories had no CVE assigned and didn’t appear in the npm advisory feed. That means npm audit won’t warn you about them. Automated scanning tools will miss these. Manual action is the only way to know you’re covered.
This situation is a good example of why dependency scanning alone isn’t enough, something we’ve written about in the context of other high-severity flaws like the Fastjson RCE flaw that caught many teams off guard. The full technical breakdown from The Hacker News is worth reading if your team wants the deeper detail.
If your web app is managed by an outside developer or agency, send them this article today and ask for written confirmation that the upgrade is done. If your internal team owns it, this belongs at the top of the queue, not the backlog. For businesses that want ongoing visibility into what’s running in their environment, Exine’s managed IT and cybersecurity for businesses includes exactly that kind of proactive monitoring.
FAQ
Does this Next.js flaw affect my WordPress site?
No. These vulnerabilities are specific to applications built on Next.js, a JavaScript framework. WordPress runs on PHP and is a completely separate platform. If you’re unsure what technology your site uses, ask your developer or web host and they can confirm it quickly.
What is remote code execution and why is it dangerous?
Remote code execution means an attacker can run their own commands on your server over the internet without logging in. They can steal data, install malware, or use your server to attack others. A CVSS score of 9.5, which both Next.js flaws carry, means the risk is considered critical.
Will npm audit catch these Next.js vulnerabilities?
Not fully. As of October 15, 2026, two of the three flaws had no CVE and were absent from the npm advisory feed. The SVG flaw does surface through sharp’s own advisory. You need to check versions manually and apply the upgrade regardless of what automated scanning reports.
How do I know which version of Next.js my app is running?
Open your project’s package.json file and look for the next entry under dependencies. You can also run npx next –version in the project directory. If the version is below 16.4.1 or 15.5.28, the upgrade is needed now.
