Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.
One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.
The fixes are in Next.js 16.4.1 and 15.5.28, the current Active and Maintenance long-term support (LTS) releases.
16.4.1 ships the same optimizer as 16.4.0 and fixes the image flaw by raising the bundled sharp to 0.35.5, which carries a patched librsvg (2.63.2).
It describes the flaw as affecting "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." In a Next.js app, the trigger is a use cache function that returns more than one typed array, so only version 16 apps that enable Cache Components, the feature behind use cache , are exposed.
The first code-execution flaw is in React Server Components, the React feature that runs user-interface components on the server.
sharp's maintainer also warns that whether the flaw ends in code execution or only a crash can come down to the server's Node.js build, because the official Node.js binaries are not hardened against this kind of memory attack.
Serving them through the image optimizer requires turning on a setting called dangerouslyAllowSVG .
Code execution is possible when Next.js runs on glibc-based Linux, according to the advisory.
The librsvg bug, CVE-2026-96889 , was made public on September 23 and fixed in sharp on September 27.
What happened
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.
One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.
What changed
The fixes are in Next.js 16.4.1 and 15.5.28, the current Active and Maintenance long-term support (LTS) releases.
16.4.1 ships the same optimizer as 16.4.0 and fixes the image flaw by raising the bundled sharp to 0.35.5, which carries a patched librsvg (2.63.2).
Who is affected
It describes the flaw as affecting "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." In a Next.js app, the trigger is a use cache function that returns more than one typed array, so only version 16 apps that enable Cache Components, the feature behind use cache , are exposed.
The first code-execution flaw is in React Server Components, the React feature that runs user-interface components on the server.
Why it matters
sharp's maintainer also warns that whether the flaw ends in code execution or only a crash can come down to the server's Node.js build, because the official Node.js binaries are not hardened against this kind of memory attack.
Serving them through the image optimizer requires turning on a setting called dangerouslyAllowSVG .
Technical details
Code execution is possible when Next.js runs on glibc-based Linux, according to the advisory.
The librsvg bug, CVE-2026-96889 , was made public on September 23 and fixed in sharp on September 27.
A working exploit for that earlier flaw, built for one specific server setup, has since been published.
Response
If you cannot upgrade Next.js right away, the image flaw has an interim option: make sure sharp is 0.35.5 or later, or block SVG rendering in sharp with sharp.block({ operation: ["VipsForeignLoadSvg"] }) , as the sharp advisory describes.
Check with npm ls sharp and update sharp to 0.35.5 or later if it is older.
What security teams should do
Vercel says to upgrade even if your app has no such function.
The same library also renders images for next/og , the feature that builds social-preview images, when that feature runs on the Node.js runtime.
Attribution
The Hacker News: Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.