Next.js and React Patch Critical RCE Flaws: What Developers Must Do

Next.js 16.4.1 and 15.5.28 fix two critical, unauthenticated RCE flaws in use cache and SVG handling. Here's who's exposed and why npm audit may miss it.

TheTechLane cover: a glowing server rack split by a red crack as malicious data streams in, with the headline Next.js & React Patch Critical RCE Flaws

Next.js and React shipped an out-of-band security release on October 14 that fixes two critical flaws letting an unauthenticated attacker run code on your server, both rated 9.5 out of 10. If you run Next.js 15 or 16 in production, this is a patch-today job, not a next-sprint ticket.

Here's what you need to know:

  • Next.js 16.4.1 and 15.5.28 are the fixed releases, covering two critical remote code execution (RCE) bugs and one high-severity denial-of-service bug.

  • One RCE sits in React Server Components and hits Next.js 16 apps using Cache Components and use cache.

  • The other lives in librsvg, which Next.js reaches through sharp when it processes SVG images on glibc-based Linux.

  • The use cache and Server Actions bugs have no workaround. Only upgrading fixes them.

  • As of October 15, two of the advisories weren't in the npm audit feed, so your scanner may say you're fine when you're not.

Diagram of the three Next.js flaws fixed on October 14, 2026: RCE in use cache, RCE via SVG image processing, and denial of service via Server Actions, with affected and fixed versions

The three flaws in the October 14 Next.js release, who each one hits, and the version that fixes it.

What Happened

On October 14, the Next.js team published its out-of-band security update for upstream vulnerabilities, saying it included two fixes postponed from the September release "due to upstream dependency delays." The patches landed in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS).

The first critical bug, GHSA-673q-mjm6-r5xr, affects Next.js 16.0.0 through 16.4.0. Apps using the App Router with Cache Components can be hit with unauthenticated RCE when a use cache function returns multiple typed arrays. Vercel says there's no known workaround and tells teams to "upgrade immediately even if your application does not have similar functions."

It traces back to React itself. The React Server Components advisory GHSA-xqc2-xf4c-x3h3 covers react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack from 19.0.0 through 19.3.0. React describes it as affecting "extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." The fixed versions are 19.0.9, 19.1.10, 19.2.9 and 19.3.1.

The second critical bug, CVE-2026-96889 (GHSA-2464-fhr4-w9xw), has a much wider version range: Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. A memory bug in an upstream image library can lead to RCE when Next.js runs on glibc-based Linux. The interim fix is making sure sharp is 0.35.5 or later.

According to The Hacker News, the library is librsvg. Next.js doesn't optimize SVGs by default; that needs the dangerouslyAllowSVG setting. But the same library also renders next/og social images on the Node.js runtime. The outlet also reports that as of October 15 there were no public reports of any of the three flaws being exploited.

The third fix is a high-severity DoS in App Router apps with at least one Server Action, where crafted requests can max out a server process's CPU.

Why It Matters

Here's our take: this release is a wake-up call about how much of your attack surface you don't actually write. Not one of these bugs started in code you'd recognise. One came from React's serialization layer, one from a C library three hops down your dependency tree. Your app inherited both the moment you ran npm install.

The "extremely rare" wording reads like "probably not me." Resist that. Vercel itself says to upgrade even if you don't have the vulnerable pattern, and that's the right call. You can't audit every use cache function in a big codebase as fast as you can bump a version.

The image path is the bigger worry. The Hacker News notes this is the third time since August that image processing in Next.js has produced a code-execution flaw. When one part of a framework keeps breaking, the lesson isn't "patch and forget." Treat any feature that parses untrusted files, especially SVGs, as high-risk by design.

Then there's tooling. If the use cache and Server Actions advisories weren't in the npm audit feed as of October 15, a green CI badge didn't mean much that week. "npm audit is clean" is a signal, not a security posture.

It's the same lesson our coverage of the OpenCode Console breach pointed to: the riskiest parts of your stack are often the ones you trust by default.

What It Means for Developers

Four-step patch flow for Next.js apps: check the Next.js version, upgrade to 16.4.1 or 15.5.28, verify sharp is 0.35.5 or later, then redeploy and delete stale preview deploys

The patch path: upgrade, verify sharp, redeploy, and clean up old previews.

Run this on every Next.js app you own, including forgotten side projects:

  • Upgrade now. Run npm install next@16.4.1 on the 16.x line or npm install next@15.5.28 on 15.x, as the Next.js team recommends. Then rebuild and redeploy.

  • Check sharp separately on 15.x. The Hacker News reports that 15.5.28 still accepts the vulnerable sharp 0.34.x, and an upgrade over an existing install can leave it in place. Run npm ls sharp and make sure it's 0.35.5 or later.

  • Patch RSC packages directly if you use React Server Components outside Next.js: move react-server-dom-* to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.

  • Can't upgrade today? For the image flaw only, The Hacker News points to the sharp advisory's option to block SVG rendering with sharp.block({ operation: ["VipsForeignLoadSvg"] }). Nothing stops the use cache bug except the upgrade.

  • Audit SVG exposure. Search your config for dangerouslyAllowSVG and check whether any next/og route renders user-supplied input.

  • Kill stale deploys. Netlify warns that public deploy previews and branch deploys may stay vulnerable until they're deleted. The same logic applies on any host.

  • Don't wait for your host. Pantheon's release note spells it out: customers update dependencies and redeploy, and Pantheon won't do it for them.

  • Subscribe to the source. Watch the Next.js and React GitHub security advisories directly instead of relying only on npm audit or Dependabot.

What's Next

The open question is exploitation. As of October 15, there were no public reports of attacks using these bugs, per The Hacker News. But patch diffs are public now, and the React Server Components packages involved are the same ones behind React2Shell, the maximum-severity flaw from December 2025 that attackers exploited at scale. It's far narrower, but attackers know where to look.

Watch for CVE IDs on the use cache and Server Actions advisories and for them to reach scanner feeds. Also watch whether Next.js changes how its image pipeline handles SVGs after this run of bugs. Vercel hasn't said whether more fixes are coming.

FAQ

Is my Next.js app affected?

If you're on Next.js 15.x below 15.5.28 or 16.x below 16.4.1, at least one of the three advisories likely applies. The use cache RCE only hits 16.x apps with Cache Components, but Vercel advises upgrading regardless.

Does npm audit catch these flaws?

Not reliably yet. The Hacker News reported that as of October 15 the use cache and Server Actions advisories had no CVE and weren't in the npm audit feed. The image flaw does show up through sharp's own advisory.

Are these bugs being exploited?

As of October 15, there were no public reports of exploitation, according to The Hacker News. That can change fast once patches are public, so don't wait for proof.

Sources

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane.

Learn • Build • Share

Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.