Next.js Patches Two Critical RCE Flaws and a DoS

Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCE bugs and a Server Actions denial of service, with no exploitation reported.

On October 14, Next.js released out-of-band patches in 16.4.1 and 15.5.28 for two critical unauthenticated remote-code-execution flaws, each scored CVSS 9.5, and a high-severity Server Actions denial-of-service bug that Cyber Security News scored 8.2. CVE-2026-96889 allows unauthenticated code execution on glibc-based Linux when the Image Optimization API processes SVGs; GBHackers attributes the memory flaw to sharp, while The Hacker News calls it a librsvg bug reached through sharp and says the fix raises sharp to 0.35.5 with librsvg 2.63.2. Cyber Security News says that image flaw affects Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0 and that sharp 0.35.5 covers only this bug. The second critical issue, GHSA-673q-mjm6-r5xr, has no CVE and affects Next.js 16.0.0–16.4.0 App Router apps with Cache Components when a cached function returns more than one typed array; reports describe it as rare, linked to React Server Components, and without a workaround. Separately, GHSA-p3m5-59mp-jv5r can exhaust CPU through crafted requests to exposed Server Actions on 13.0.0–15.5.27 and 16.0.0–16.4.0 and also has no workaround. As of October 15, the outlets said Vercel and public reporting had not identified active exploitation of any of the three flaws.

• On October 14, Next.js shipped out-of-band fixes in 16.4.1 and 15.5.28 for three flaws.
• Two unauthenticated RCE bugs are each scored CVSS 9.5; the Server Actions denial of service is high severity and scored 8.2 by Cyber Security News.
• CVE-2026-96889 is an SVG Image Optimization memory flaw enabling unauthenticated RCE on glibc Linux, affecting 10.0.0–15.5.27 and 16.0.0–16.4.0; sources differ on sharp versus librsvg, and the fix needs sharp 0.35.5 or later (librsvg…
• GHSA-673q-mjm6-r5xr has no CVE and affects Next.js 16.0.0–16.4.0 App Router Cache Components when a cached function returns multiple typed arrays; no workaround is reported.
• GHSA-p3m5-59mp-jv5r can exhaust CPU through Server Actions on 13.0.0–15.5.27 and 16.0.0–16.4.0, has no workaround, and is fixed in 15.5.28 and 16.4.1.
• As of October 15, Vercel and the reports said none of the three flaws was known to be exploited.