Next.js Security Update for Upstream Vulnerabilities
Next.js shipped emergency patches for two unauthenticated RCEs, one with no workaround at all.
Next.js released v16.4.1 and v15.5.28 to fix two critical unauthenticated remote code execution vulnerabilities and one high-severity denial of service bug. One RCE affects App Router apps using Cache Components with 'use cache' functions returning typed arrays and has no workaround; the other affects SVG image optimization on glibc-based Linux via an upstream sharp library flaw. The DoS bug affects App Router apps using Server Actions, where crafted requests can exhaust CPU and block further requests.
Why it matters
Next.js is one of the most widely deployed React frameworks, and unauthenticated RCE in default App Router features (caching and image optimization) means a large population of production apps are exposed until patched, with one bug having no mitigation short of upgrading.
What is verified
Next.js released v16.4.1 and v15.5.28 to fix two critical unauthenticated remote code execution vulnerabilities and one high-severity denial of service vulnerability. [1]
One critical RCE affects App Router applications using Cache Components where a 'use cache' function returns multiple typed arrays, and has no known workaround. [1]
A second critical RCE affects the Image Optimization API when processing SVGs on glibc-based Linux, stemming from a memory-related vulnerability in the upstream 'sharp' library; a workaround is to ensure sharp is version 0.35.5 or later. [1]
A high-severity denial of service vulnerability affects App Router applications using at least one Server Action, where crafted requests cause excessive CPU usage that blocks further request processing in the same process; Pages Router apps or apps without Server Actions are not vulnerable. [1]
These fixes were postponed from the September security release due to upstream dependency delays. [1]
What is not
- No detail on how widely exploited these vulnerabilities are in the wild, or whether any proof-of-concept exploits are public.
- No information on how many production Next.js deployments use Cache Components, SVG image optimization on glibc Linux, or Server Actions, so the practical exposure size across the ecosystem is not quantified.
- The evidence does not state whether earlier Next.js major versions (below 15.5) also require patching or are out of support.
Sources
- 1Next.js Blognextjs.org · Primary source
Original source published 14 October 2026 at 20:00.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.