Next.js Fixes Two Critical Remote Code Execution Vulnerabilities and a High-Severity DoS Flaw

Next.js released an out-of-band security update on October 14, 2026, addressing two critical vulnerabilities that could allow unauthenticated remote code execution (RCE), along with a high-severity denial-of-service (DoS) flaw.

The two RCE vulnerabilities affect React Server Components and the librsvg library, which Next.js uses through the sharp package to process SVG images. Both critical flaws carry a CVSS score of 9.5.

The fixes are available in Next.js 16.4.1 and 15.5.28. Developers are advised to upgrade their applications and verify that the installed image-processing dependencies are also patched.

Three Security Vulnerabilities Addressed

The October 14 update resolves three separate security issues:

• React Server Components RCE (GHSA-673q-mjm6-r5xr): Affects Next.js 16.0.0 through 16.4.0 when Cache Components are enabled and a use cache function returns multiple typed arrays. The vulnerability is fixed in Next.js 16.4.1.
• SVG Image Processing RCE (CVE-2026-96889): Affects versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 under specific conditions involving attacker-controlled SVG files and sharp on glibc-based Linux systems. The fix is available in Next.js 16.4.1 or 15.5.28 with sharp 0.35.5 or later.
• Server Actions Denial of Service (GHSA-p3m5-59mp-jv5r): Affects App Router applications with at least one Server Action. Crafted requests can cause a server process to consume all available CPU resources, disrupting service. The issue is fixed in versions 15.5.28 and 16.4.1.

Who Is at Risk?

1. React Server Components Vulnerability

The first RCE vulnerability affects React Server Components packages, including react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, in versions 19.0.0 through 19.3.0.

The issue occurs in extremely rare cases involving responses that transport multiple typed arrays alongside an attacker-controlled value. In Next.js, exposure is limited to version 16 applications using Cache Components where a use cache function returns more than one typed array.

Vercel recommends upgrading even if an application does not currently contain a function matching this condition.

2. Remote Code Execution Through SVG Images

The second critical vulnerability originates in librsvg, an open-source library used to render SVG images. Next.js reaches this library through the sharp image-processing package.

Exploitation can result in code execution when affected image-processing functionality handles a malicious SVG on a glibc-based Linux system.

Next.js does not optimize SVG files by default. However, applications that enable the dangerouslyAllowSVG image configuration or use SVG rendering through next/og on the Node.js runtime may be exposed under the relevant conditions.

This vulnerability highlights the security risks associated with processing attacker-controlled image files on application servers.

3. Denial of Service Through Server Actions

The third vulnerability affects Next.js App Router applications that define at least one Server Action.

An attacker can send specially crafted requests that drive a server process to full CPU utilization, preventing it from handling legitimate traffic.

Applications using the Pages Router or applications without Server Actions are not affected by this particular issue.

Exposure can also vary by hosting environment. Netlify reported that its platform does not execute the affected image-optimizer code path and described the impact on its setup as limited, while still recommending that customers upgrade.

How to Protect Your Next.js Application

Developers should upgrade to the appropriate patched release:

• Next.js 16: Upgrade to version 16.4.1.
• Next.js 15: Upgrade to version 15.5.28.

After upgrading, rebuild and redeploy the application.

The sharp dependency requires additional attention. Next.js 16.4.1 requires sharp 0.35.5, which includes the patched librsvg version. However, Next.js 15.5.28 may retain an older, vulnerable sharp 0.34.x installation.

Check the installed version using:

npm ls sharp

If the installed version is older than 0.35.5, update it and verify the dependency tree before redeploying.

If an immediate Next.js upgrade is not possible, the SVG vulnerability has an interim mitigation. Developers can use sharp 0.35.5 or later, or block SVG rendering in sharp with the following configuration:

sharp.block({ operation: ["VipsForeignLoadSvg"] })

This mitigation applies only to the image-processing vulnerability. There is no workaround for the React Server Components RCE and Server Actions DoS flaws; upgrading to a patched Next.js release is necessary to address them.

Developers should also avoid relying exclusively on automated dependency scanners. As of October 15, the advisories for the use cache and Server Actions vulnerabilities had no CVE identifiers and were not appearing in the npm advisory feed used by npm audit.

Repeated Security Issues in Image Processing

The October update marks another image-processing-related code-execution vulnerability affecting the Next.js ecosystem in recent months.

In August 2026, a vulnerability in libheif, reached through sharp, enabled code execution when the image optimizer processed a specially crafted AVIF image. In September, another vulnerability involving next/og allowed attacker-controlled text to alter generated SVG content.

For the latest issue, Next.js did not need to change its image-optimizer implementation. Instead, version 16.4.1 updates the bundled sharp dependency to version 0.35.5, which includes a patched librsvg version, 2.63.2.

The underlying librsvg vulnerability, tracked as CVE-2026-96889, became public on September 23 and was fixed in sharp on September 27. Red Hat assigned it a CVSS score of 7.8, while Vercel rated the vulnerability's exposure through Next.js at 9.5 because of its network-reachable attack surface.

The severity of exploitation can also depend on the server's Node.js build. According to the sharp maintainer, differences in memory protections may determine whether exploitation results in code execution or a process crash.

Not the Same as React2Shell

The React Server Components vulnerability affects the same three packages involved in React2Shell, the maximum-severity vulnerability disclosed in December 2025 that was subsequently exploited at scale.

However, the newly disclosed issue has a much narrower trigger. React describes it as affecting extremely rare cases involving multiple typed arrays and an attacker-controlled value.

As of October 15, 2026, there were no public reports of exploitation involving the three vulnerabilities addressed in the October 14 update.

Organizations running Next.js should prioritize upgrading, checking their sharp dependency versions, and validating their deployments to reduce the risk of remote code execution and service disruption.