Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js 16.4.1 and 15.5.28 patch two critical unauthenticated RCE bugs and a Server Actions denial of service.
Next.js released an out-of-band update on October 14 in 16.4.1 and 15.5.28 fixing two critical unauthenticated remote code execution flaws, each CVSS 9.5, and a high-severity Server Actions denial of service. One RCE, tracked as GHSA-673q-mjm6-r5xr, affects React Server Components only in rare cases where a use cache function returns more than one typed array on Next.js 16 with Cache Components enabled. The other, CVE-2026-96889, is a librsvg memory bug reached through sharp when attacker-supplied SVGs are processed on glibc Linux; the fix raises sharp to 0.35.5 with librsvg 2.63.2. As of October 15 there were no public reports that any of the three flaws had been used in attacks.