Next.js Security Update: Two Critical Flaws Fixed on Oct 14, 2026

The Next.js team released the out-of-band security update it announced on October 8 on October 14, 2026. The update fixes three vulnerabilities originating in upstream dependencies: two rated Critical and one rated High.

The fixes for two of these vulnerabilities had been postponed from the September security release because of delays on the upstream side. In other words, there was a pending debt, and it is now being paid. In this post I will explain what the vulnerabilities are, who they affect, and what you need to update.

Which Versions Contain the Fix?

The patches were released on two release lines:

• v16.4.1 (Active LTS)
• v15.5.28 (Maintenance LTS)

Update commands:

# 15.5 hattı için
npm install [email protected]

# 16.4 hattı için
npm install [email protected]

What does it do? It pins your Next.js dependency to the patched version. That's all there is to it.

Which Vulnerabilities Were Fixed?

1. Unauthenticated RCE in use cache Functions (Critical)

Identifier: GHSA-673q-mjm6-r5xr (Next.js). Related upstream advisory: GHSA-xqc2-xf4c-x3h3 (React).

In an application that uses the App Router with Cache Components, unauthenticated Remote Code Execution (RCE) may be possible when a use cache function returns multiple typed arrays.

There is no known workaround for this vulnerability. On top of that, the source includes an explicit warning: you should upgrade immediately even if your application has no similar functions.

2. RCE via SVG in the Image Optimization API (Critical)

Identifier: CVE-2026-96889 / GHSA-2464-fhr4-w9xw.

A memory-related vulnerability in an upstream library used for Image Optimization can lead to remote code execution when Next.js runs on glibc-based Linux.

As a temporary mitigation, you can make sure the sharp version used by Next.js is 0.35.5 or higher. However, when you upgrade Next.js to the patched version, package managers already pull in the fixed sharp version on their own.

3. Denial of Service in the App Router via Server Actions (High)

Identifier: GHSA-p3m5-59mp-jv5r (Next.js). Related upstream advisory: GHSA-h3gv-c5rc-p453 (React).

Specially crafted requests sent to applications that use the App Router and contain at least one Server Action can cause excessive CPU usage. This CPU usage also blocks other requests in the same process, resulting in Denial of Service (DoS).

Applications that use the Pages Router or do not use any Server Actions are not affected by this vulnerability.

Risk Summary

• use cache + typed array: Critical, RCE, no workaround
• Image Optimization + SVG: Critical, RCE, glibc-based Linux
• Server Actions: High, DoS, App Router only

Who Is Affected / What Should You Do?

⚠️ Important warning: Since there is no workaround for the first vulnerability, do not postpone this update if you use the App Router and Cache Components.

We can summarize the impact briefly as follows:

• If you use the App Router + Cache Components, the first vulnerability concerns you
• If you run Next.js image optimization on glibc-based Linux, the second vulnerability concerns you
• If you have at least one Server Action in the App Router, the third vulnerability concerns you

Let's go step by step:

Step 1 — Identify your release line. If your project is on the 15.5 line, move to v15.5.28; if it is on the 16.4 line, move to v16.4.1.

Step 2 — Apply the update. Run the appropriate npm install command above.

Step 3 — Redeploy. If the update stays only on your local machine, production is not protected.

ℹ️ Note: The sources do not include any patch information for versions outside these two lines. If you are on a different release line, check the relevant GHSA advisories.

Final Thoughts

This update shows once again that risk can lie not only in Next.js code but also in the dependencies beneath it. The use cache and Server Actions vulnerabilities are linked to the relevant React advisories; the SVG vulnerability comes from an upstream library used by Image Optimization.

In short: there are two Critical RCEs and one High DoS, and the patch is ready. With vulnerabilities like these, postponing the update always costs more than applying the patch.