Next.js has released a crucial security update on October 14, addressing two critical remote code execution (RCE) vulnerabilities, alongside a high-severity denial-of-service (DoS) issue. These vulnerabilities are significant as they allow unauthorized code execution in affected systems.
Details of the Vulnerabilities
The security patch targets three main issues. The first RCE vulnerability is linked to React Server Components, while the second is associated with librsvg, an open-source library for handling SVG images via the sharp package. The flaws have been patched in Next.js versions 16.4.1 and 15.5.28, which are the latest long-term support releases.
Vercel, the company behind Next.js, has classified both RCE vulnerabilities as critical, each carrying a CVSS score of 9.5. The affected versions and the corresponding updates have been clearly outlined to assist developers in securing their applications.
Who Is Affected?
Applications using the React Server Components feature, which operates user-interface components server-side, are susceptible to the first RCE flaw. This issue pertains to specific instances where a use cache function returns multiple typed arrays, especially in version 16 apps.
The second issue involves a memory bug in librsvg, which is utilized by Next.js through the sharp package for SVG image rendering. This vulnerability is particularly concerning for applications running on glibc-based Linux systems. By default, Next.js does not optimize SVG files, but enabling certain settings can expose applications to risk.
Mitigation and Future Outlook
To mitigate these vulnerabilities, it is imperative to upgrade to Next.js 16.4.1 for version 16, or 15.5.28 for version 15. Developers should also ensure that the sharp package is updated to version 0.35.5 or later. If immediate upgrading is not feasible, temporary measures include blocking SVG rendering in sharp.
This marks the third instance since August where Next.js has faced code execution vulnerabilities related to image processing. The community is urged to remain vigilant and keep their software updated as dependency scanners might not always flag these issues immediately.
In summary, the swift response by Vercel highlights the ongoing challenges in maintaining security within complex software ecosystems. Continuous updates and proactive security measures are essential to safeguard against evolving threats.
