Next.js Vulnerabilities Permit Remote Code Execution

Recent updates to Next.js have addressed two critical vulnerabilities that pose a significant security risk by allowing remote execution of malicious code. These vulnerabilities do not require authentication, making them particularly dangerous. A third, less severe flaw can disrupt application services, highlighting the need for immediate attention and action from developers.

Details of the Security Vulnerabilities

The vulnerabilities, which involve cached functions, SVG image handling, and Server Actions, have been patched in the latest Next.js versions 16.4.1 and 15.5.28. These issues were publicly disclosed in advisories released on October 14, 2026, detailing unique attack vectors with specific prerequisites.

The remote code execution vulnerabilities have been rated at a severity score of 9.5, while the denial-of-service flaw is rated at 8.2. The extent of exposure depends on the application’s configuration and the features in use, necessitating more than just version checks for a complete risk assessment.

In-Depth Analysis of the Flaws

The first flaw, identified as GHSA-673q-mjm6-r5xr, affects applications using the App Router with Cache Components. This issue arises when a cache function returns multiple typed arrays, enabling attackers to execute code remotely without user intervention. This vulnerability impacts versions from 16.0.0 to 16.4.0, with a fix available in version 16.4.1. Developers are urged to upgrade immediately, as there is no workaround or CVE identifier for this issue.

The second flaw, CVE-2026-96889, is rooted in a memory vulnerability within an upstream library used by the Image Optimization API to process SVG files. This can result in remote code execution on systems using glibc-based Linux. The advisory indicates no need for special privileges or user interaction, affecting versions 10.0.0 through 15.5.27 and those above 16.0.0 through 16.4.0. Upgrading to sharp 0.35.5 or later is recommended to resolve this issue.

Preventive Measures and Recommendations

The third vulnerability, GHSA-p3m5-59mp-jv5r, targets App Router applications that utilize Server Actions. This flaw can cause excessive CPU usage, leading to denial-of-service by preventing the processing of additional requests. Affected versions include 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0, with no workaround available other than upgrading to the latest versions.

Developers are strongly advised to update to Next.js versions 15.5.28 or 16.4.1, depending on their current setup. While updating the sharp library can address the image-related flaw, it does not fix the other vulnerabilities associated with cached functions or Server Actions.

Ensuring defenses against emerging cyber threats is crucial, and integrating Threat Intelligence Feeds with data from 16,000 Security Operation Centers can provide heightened security awareness and protection.