Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js Ships Emergency Patch for Two Critical RCE Flaws

Vercel shipped an out-of-band security release for Next.js on October 14, 2026, fixing two critical unauthenticated remote code execution flaws — both rated CVSS 9.5 — alongside a high-severity denial-of-service bug. The fixes landed in Next.js 16.4.1 (Active release line) and Next.js 15.5.28 (Maintenance LTS line). One RCE lives in React Server Components, triggered when a use cache function returns more than one typed array; the other is a memory-corruption flaw in librsvg, the SVG-rendering library Next.js reaches through the sharp image-processing package. Vercel had pre-announced the coming out-of-band release on October 8, 2026, giving operators advance notice before the patches landed.

Only the librsvg/SVG flaw has an assigned CVE — CVE-2026-96889 (GHSA-2464-fhr4-w9xw) — as of this writing. The React Server Components RCE (GHSA-673q-mjm6-r5xr) and the Server Actions denial-of-service bug (GHSA-p3m5-59mp-jv5r) remain GHSA-only, which means dependency scanners relying solely on the npm advisory feed for CVE-indexed alerts may not flag them.

Vulnerability Overview

Attribute	Value
Vendor	Vercel (Next.js)
Disclosure / Patch Date	October 14, 2026 (pre-announced October 8, 2026)
Release Type	Out-of-band (emergency) security update
Critical Flaws	2 — unauthenticated RCE, CVSS 9.5 each
High-Severity Flaw	1 — Server Actions denial-of-service
CVE Assigned	CVE-2026-96889 (librsvg/SVG flaw only)
GHSA-Only Advisories	GHSA-673q-mjm6-r5xr (Cache/RSC RCE), GHSA-p3m5-59mp-jv5r (Server Actions DoS)
Fixed Versions	Next.js 16.4.1 (Active); Next.js 15.5.28 (Maintenance LTS)
Exploitation Status	No public reports of in-the-wild exploitation of these specific flaws as of October 15, 2026
Workaround Available	Partial — only for the SVG/librsvg flaw; none for the other two

How the Flaws Work

RCE #1: Multiple Typed Arrays in Cached Server Functions

Tracked as GHSA-673q-mjm6-r5xr, this flaw affects Next.js 16.0.0 through 16.4.0 and is fixed in 16.4.1. It is rooted in React Server Components, specifically in the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages in React 19.0.0 through 19.3.0. React's own advisory describes the underlying issue as affecting "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." In a Next.js application, the trigger condition is a use cache function that returns more than one typed array. Only Next.js 16 applications with Cache Components enabled are exposed — Next.js 15 and earlier do not have the Cache Components feature and are not affected by this specific flaw. No workaround exists beyond upgrading.

RCE #2: Memory Corruption in librsvg via sharp

The second critical flaw, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), affects a much wider version range: Next.js 10.0.0 through 15.5.27, and 16.0.0 through 16.4.0. It is fixed in 16.4.1, or in 15.5.28 combined with sharp 0.35.5 or later. The root cause is a memory-corruption vulnerability in librsvg, the open-source SVG rendering library that Next.js accesses indirectly through the sharp image-processing package. Code execution becomes possible when a Next.js application running on glibc-based Linux processes an attacker-supplied SVG file — exposure applies to apps that enable the dangerouslyAllowSVG configuration option or use next/og (ImageResponse) on the Node.js runtime. macOS, Windows, and musl-based Linux builds (such as Alpine) are out of scope for this specific RCE path per the advisory.

Security researcher Rafael B. Dias identified this librsvg flaw as the underlying weakness behind September's next/og ImageResponse vulnerability (CVE-2026-94545, previously covered by CosmicBytez Labs), where unescaped values reaching Satori's SVG output could trigger code execution in "other dependent libraries" that Vercel had not named at the time. That dependent library is librsvg. Public disclosure of the librsvg-level issue occurred September 23, 2026, with sharp shipping a fix on September 27, 2026 — meaning this is now the third image-processing RCE disclosed against Next.js since August 2026, following a prior libheif/AVIF vulnerability and the September next/og SVG flaw.

There is an important gotcha for teams on the Next.js 15.x line: [email protected] still accepts sharp ^0.34.3 || ^0.35.5 as valid dependency ranges. A project whose lockfile already resolved sharp 0.34.x can upgrade Next.js to the patched release and still retain the vulnerable SVG decoder, because npm will not force an upgrade to 0.35.5 on its own.

High-Severity DoS: Server Actions CPU Exhaustion

The third flaw, GHSA-p3m5-59mp-jv5r, is rated high severity (not critical) and affects Next.js 13.0.0 through 15.5.27, and 16.0.0 through 16.4.0. It is fixed in 15.5.28 and 16.4.1. Vercel's advisory describes the issue as allowing crafted requests to drive a single server process to full CPU consumption, preventing that process from handling additional requests. Only App Router applications that define at least one Server Action are affected; applications using the Pages Router, or App Router apps with zero Server Actions, are not vulnerable to this bug.

Impact Assessment

Impact Area	Description
Code Execution Risk	Two unauthenticated, CVSS 9.5 code-execution paths — one via cached React Server Component responses, one via SVG image processing — give attackers full server compromise without credentials
Service Availability	The Server Actions DoS flaw can take a server process offline with a single crafted request, independent of the RCE bugs
Scope of Exposure	The librsvg/SVG flaw spans six years of Next.js releases (10.0.0 onward); the RSC and DoS flaws are narrower but still touch both the 15.x and 16.x lines
Detection Gap	Two of the three advisories have no assigned CVE, so automated dependency scanners keyed to CVE feeds (rather than GHSA IDs) may silently miss them
Self-Hosted Risk Amplification	Teams self-hosting with glibc-based Linux and a pinned/outdated `sharp` version can remain exposed to the SVG RCE even after upgrading Next.js, due to permissive version ranges in the 15.5.28 dependency manifest
Recurring Pattern	This is the third Next.js image-processing RCE since August 2026, indicating the SVG/image pipeline (Satori, sharp, librsvg) is a recurring high-value attack surface

Recommendations

For Next.js Administrators and DevOps

Upgrade immediately: run npm install [email protected] for the 15.5 Maintenance LTS line, or npm install [email protected] for the 16.4 Active line.
Explicitly verify sharp, especially on the 15.5 line: run npm ls sharp and confirm the resolved version is 0.35.5 or later — do not assume the Next.js upgrade alone remediates the SVG RCE.
If you cannot upgrade sharp immediately, mitigate the librsvg path with sharp.block({ operation: ["VipsForeignLoadSvg"] }) to block SVG decoding outright.
Confirm whether your deployment uses Cache Components (Next.js 16) or Server Actions (App Router) — both are required conditions for two of the three flaws, and disabling the feature is not a substitute for patching, but helps you triage urgency.

For Security Teams

Do not rely solely on CVE-based scanning — two of the three advisories (GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r) have no CVE ID as of October 15, 2026, and will not surface in npm audit or CVE-indexed SCA tooling. Track the GHSA identifiers directly.
Audit self-hosted deployment targets for OS/libc, since the librsvg RCE applies specifically to glibc-based Linux and does not apply to macOS, Windows, or musl builds — prioritize patching accordingly.
Flag any application using dangerouslyAllowSVG or next/og on the Node.js runtime for immediate review, as these are the explicit exposure conditions for the SVG RCE.
Review whether platform-hosted Image Optimization (e.g., on Vercel) behaves differently from self-hosted sharp paths in your environment before assuming managed hosting fully mitigates risk.

For Teams Still Running Patched-Satori / Unpatched-librsvg Combinations

If you already patched the September next/og Satori escaping bug (CVE-2026-94545), treat that as a separate fix — it does not guarantee the librsvg memory-corruption path is closed. Apply this October update independently.

Key Takeaways

Vercel shipped an out-of-band Next.js release on October 14, 2026 fixing two critical (CVSS 9.5) unauthenticated RCE flaws and one high-severity DoS bug, landing in 16.4.1 and 15.5.28.
One RCE is in React Server Components (use cache returning multiple typed arrays, Next.js 16.0.0–16.4.0); the other is a librsvg memory-corruption bug reached via sharp (CVE-2026-96889, Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0).
Only CVE-2026-96889 has an assigned CVE — the other two advisories are GHSA-only and may not appear in CVE-indexed dependency scanners.
Upgrading Next.js alone may not fix the SVG RCE on the 15.5 line — [email protected] still permits sharp 0.34.x in its dependency range, so lockfiles must be checked manually (npm ls sharp) for version 0.35.5 or later.
This is the third Next.js image-processing RCE since August 2026, following a libheif/AVIF flaw and September's next/og Satori escaping bug — librsvg is the previously unnamed "dependent library" behind that earlier issue.
The Server Actions DoS flaw only affects App Router apps with at least one Server Action defined; Pages Router apps and Server-Action-free App Router apps are not vulnerable to that specific bug.