Critical Next.js Vulnerabilities Allow Hackers to Execute Malicious Code Remotely
Next.js patches two unauthenticated remote-code-execution flaws and a denial-of-service bug in 15.5.28 and 16.4.1.
Next.js released fixes for two critical unauthenticated remote-code-execution flaws, both scored 9.5, and a high-severity denial-of-service flaw scored 8.2. GHSA-673q-mjm6-r5xr affects App Router apps using Cache Components on Next.js 16.0.0–16.4.0 when a cached function returns multiple typed arrays; it has no CVE and is fixed in 16.4.1. CVE-2026-96889 is a memory weakness in SVG handling by the Image Optimization API on glibc Linux, affecting 10.0.0–15.5.27 and 16.0.0–16.4.0, and is addressed with sharp 0.35.5 or later. GHSA-p3m5-59mp-jv5r can exhaust CPU through Server Actions on versions 13.0.0–15.5.27 and 16.0.0–16.4.0; patched releases are 15.5.28 and 16.4.1. No exploitation was reported.
- Two unauthenticated RCE flaws score CVSS 9.5; the DoS scores 8.2.
- Cache-component RCE affects Next.js 16.0.0–16.4.0 and has no CVE.
- CVE-2026-96889 is an SVG image-optimization memory flaw on glibc Linux.
- Fixes are Next.js 15.5.28 and 16.4.1; sharp 0.35.5 covers only the image bug.
Vulnerabilities mentionedAll →
- CVE-2026-968897.8<1%Use-After-Free in librsvg SVG Parsing via Nested XIncludes and Duplicate Entitiespublished · GNOME Project librsvg PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-96889 | Use-After-Free in librsvg SVG Parsing via Nested XIncludes and Duplicate Entities |
Full article420 words · extracted from cybersecuritynews.com · click to collapse
Next.js has released security updates for two critical vulnerabilities that could let remote attackers run malicious code without logging in. A third, high-severity flaw could stop affected applications from serving requests.
The issues involve cached functions, SVG image processing, and Server Actions, with fixes available in Next.js 16.4.1 and 15.5.28. Published on October 14, 2026, the advisories describe separate attack paths with different requirements
Both remote code execution flaws score 9.5, while the denial-of-service issue scores 8.2. Application settings and enabled features determine exposure, so version checks are only one part of risk assessment.
The first vulnerability, tracked as GHSA-673q-mjm6-r5xr, affects App Router applications using Cache Components. An application becomes vulnerable when a use cache function returns multiple typed arrays. Under these conditions, attackers could achieve remote code execution without authentication or user interaction.
Next.js releases 16.0.0–16.4.0 are affected by the flaw, which is fixed in version 16.4.1. Developers should upgrade immediately, as no workaround or CVE identifier is available.
Critical Next.js Vulnerabilities
Earlier React and Next.js RCE reports highlight server-side risks, but the newly disclosed cache flaw has a separate trigger and is unrelated to React2Shell.
The second flaw, CVE-2026-96889, involves a memory-related weakness in an upstream library the Image Optimization API uses to handle SVG files. It can lead to remote code execution on Next.js deployments running on glibc-based Linux. The advisory lists no required privileges or user interaction.
The official image optimization advisory lists affected versions as 10.0.0 through 15.5.27 and versions above 16.0.0 through 16.4.0.
Developers can address this issue by ensuring Next.js uses sharp 0.35.5 or later. Installing the patched Next.js releases ensures package managers provide a fixed dependency.
The third vulnerability, GHSA-p3m5-59mp-jv5r, affects App Router applications with at least one Server Action. Crafted requests can drive excessive CPU usage, preventing the same process from handling further requests. Applications using Pages Router, or those without Server Actions, are not vulnerable.
Affected versions include 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. There is no workaround besides upgrading. Previous coverage of Next.js security patches highlights related feature-specific risks, but those earlier fixes do not replace this update.
Developers should install Next.js 15.5.28 or 16.4.1 as appropriate. Updating only sharp addresses the image flaw, not the separate cached-function or Server Actions vulnerabilities.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.