Critical Next.js RCE Vulnerabilities Exposed and Patched

Key Takeaways

• Next.js has issued urgent security updates addressing two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service (DoS) flaw.
• The RCE vulnerabilities (CVSS 9.5) could allow unauthenticated attackers to execute arbitrary code, while the DoS flaw (CVSS 8.2) could render applications unresponsive.
• Affected versions include various releases across Next.js 10.x, 13.x, 15.x, and 16.x series, depending on the specific vulnerability.
• Immediate patching to Next.js 16.4.1 or 15.5.28 is strongly recommended, as some issues lack workarounds.

Next.js, a popular React framework, has released critical security updates addressing multiple severe vulnerabilities, including two remote code execution (RCE) flaws and one high-severity denial-of-service (DoS) vulnerability. These issues, if exploited, could allow unauthenticated attackers to execute malicious code or disrupt application availability.

The patches, detailed in security advisories published on October 14, 2026, target vulnerabilities related to cached functions, SVG image processing, and Server Actions. Developers are urged to upgrade to Next.js 16.4.1 or 15.5.28 without delay to mitigate these risks.

Both RCE vulnerabilities carry a CVSS score of 9.5, indicating critical severity, while the DoS flaw is rated 8.2. The specific exposure to these vulnerabilities depends on an application’s configuration and enabled features, making a simple version check insufficient for a complete risk assessment.

Critical Next.js RCE Vulnerabilities

Cache Component RCE (GHSA-673q-mjm6-r5xr)

The first critical RCE vulnerability, identified as GHSA-673q-mjm6-r5xr, impacts App Router applications that utilize Cache Components. This flaw manifests when a use cache function returns multiple typed arrays. Under these specific conditions, an attacker can achieve remote code execution without requiring any authentication or user interaction.

Next.js versions from 16.0.0 through 16.4.0 are affected by this vulnerability, which has been resolved in version 16.4.1. There is no known workaround, emphasizing the importance of immediate upgrades. This issue is distinct from previous React and Next.js RCE reports, such as React2Shell, targeting a separate attack vector.

Image Optimization API RCE (CVE-2026-96889)

The second RCE vulnerability, tracked as CVE-2026-96889, stems from a memory-related weakness within an upstream library used by the Next.js Image Optimization API for handling SVG files. This flaw can lead to remote code execution on Next.js deployments running on glibc-based Linux systems. The advisory notes that no specific privileges or user interaction are necessary for exploitation.

Affected versions include 10.0.0 through 15.5.27, and versions above 16.0.0 through 16.4.0. To address this vulnerability, developers must ensure their Next.js installation uses sharp version 0.35.5 or newer. Upgrading to the patched Next.js releases (15.5.28 or 16.4.1) will ensure that the correct, fixed dependency is automatically provided by package managers.

Server Actions Denial-of-Service (GHSA-p3m5-59mp-jv5r)

A high-severity denial-of-service vulnerability, GHSA-p3m5-59mp-jv5r, affects App Router applications that have at least one Server Action enabled. Maliciously crafted requests can cause excessive CPU consumption, effectively preventing the affected process from handling subsequent requests and leading to service disruption. Applications utilizing the Pages Router or those without any Server Actions are not susceptible to this specific flaw.

Versions 13.0.0 through 15.5.27, and 16.0.0 through 16.4.0 are impacted. Similar to the cache RCE, no workaround is available, making an upgrade the only viable solution. Previous Next.js security updates have addressed feature-specific risks, but this new patch is distinct and does not supersede earlier fixes.

For comprehensive details, developers should consult the official Next.js releases blog post.

What You Should Do

• Immediately Upgrade Next.js: Developers should update their Next.js projects to version 16.4.1 or 15.5.28, depending on their current release branch. This is the primary and most effective mitigation for all three vulnerabilities.
• Verify Dependencies: For the Image Optimization API vulnerability (CVE-2026-96889), ensure that the sharp library is updated to version 0.35.5 or later. Upgrading Next.js to the patched versions should handle this automatically.
• Assess Application Configuration: Review your application’s use of Cache Components and Server Actions, especially within the App Router, to understand your specific exposure levels.
• Monitor Official Advisories: Stay informed by regularly checking official Next.js security advisories and announcements for any further updates or new vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.