Vercel released Next.js 16.4.1 and 15.5.28 on October 14, 2026 to fix two critical unauthenticated remote code execution (RCE) vulnerabilities and one high-severity denial of service. Whether your app is exposed depends on three things: your Next.js version, whether you use App Router with Server Actions or Cache Components, and whether you self-host on glibc-based Linux.
All three flaws come from upstream code, not from Next.js itself: Vercel titled the release “Security Update for Upstream Vulnerabilities”. Two originate in React and have their own security advisories in React; the third is a memory flaw in an image library that Next.js depends on. Next.js is where they surface because it packages and calls that code.
What is an RCE vulnerability?
An RCE (remote code execution) vulnerability allows an attacker to execute their own code on your server over the network. When it’s also “unauthenticated,” the attacker doesn’t need an account or session: they just need to send a crafted request to a public app. It’s the most severe category a web framework can have, because whoever exploits it controls the process with the same permissions as your application.
What vulnerabilities does Next.js 16.4.1 fix?
The version fixes two critical RCEs and one high-severity denial of service (DoS), each with a different trigger:
| Advisory | Severity (CVSS v4) | Affected Versions | Trigger |
|---|---|---|---|
| GHSA-673q-mjm6-r5xr | Critical, 9.5 | 16.0.0 – 16.4.0 | App Router + Cache Components, with a use cache function that returns multiple typed arrays |
| CVE-2026-96889 / GHSA-2464-fhr4-w9xw | Critical, 9.5 | 10.0.0 – 15.5.27 and 16.0.0 – 16.4.0 | Image Optimization API with Next.js running on glibc-based Linux |
| GHSA-p3m5-59mp-jv5r | High, 8.2 | 13.0.0 – 15.5.27 and 16.0.0 – 16.4.0 | App Router with at least one Server Action |
Only the image vulnerability has a CVE assigned; the other two are registered as GitHub Security Advisories (GHSA).
What is the RCE in use cache functions with typed arrays?
It only affects Next.js 16. An app is vulnerable if it uses App Router with Cache Components and has a use cache function that returns multiple typed arrays. The related upstream advisory is GHSA-xqc2-xf4c-x3h3, from React.
Vercel indicates there is no known workaround, and asks you to update immediately even if your app doesn’t have functions of that type. Not returning typed arrays is a reason not to panic, not to skip the update.
What is CVE-2026-96889, the RCE in Image Optimization?
It has the broadest reach: the advisory considers all Next.js versions affected from 10.0.0 when Next.js runs on glibc-based Linux. The source is a memory flaw in the upstream library used for image optimization. The advisory title suggests it applies when using SVG files, but the text doesn’t detail the exact conditions, so don’t assume your setup keeps you safe.
What is the denial of service in Server Actions?
Crafted requests against an app with App Router and at least one Server Action can spike CPU usage to the point of blocking other requests to that process. Apps with Pages Router, or without Server Actions, are not vulnerable. The related upstream advisory is GHSA-h3gv-c5rc-p453, from React.
How do I know if my Next.js app is vulnerable?
Check three things:
- Version. Any version before 15.5.28, and any 16.x before 16.4.1, falls within the range of at least one of the advisories.
- Features. Look for
cacheComponents: truein yournext.config: it’s the option that enables Cache Components and theuse cachedirective, and became a top-level option in Next.js 16.0.0. Then search for'use server'in your code to locate Server Actions. - Runtime. If you self-host the app on Linux, check whether the system is glibc-based: that’s the scope declared by the image advisory.
If your version is affected, update even if the answers to points 2 and 3 reassure you. Vercel’s recommendation is explicit about that.
How do I update Next.js to the patched version?
Install the fixed version for your branch:
npm install next@15.5.28 # for 15.5
npm install next@16.4.1 # for 16.4
These are the exact commands from Vercel’s release. The 16.4.1 corresponds to the Active LTS branch and 15.5.28 to the Maintenance LTS branch. According to the image advisory, updating Next.js also causes your package manager to install a fixed version of sharp.
What do I do if I can’t update Next.js today?
For the image RCE, the workaround in the advisory is to ensure that the sharp Next.js uses is 0.35.5 or later. New installations already get a fixed version, but an existing lockfile can hold an old one.
Check which version you have installed:
npm ls sharp
If it’s before 0.35.5, you can force the version with npm’s overrides in your root package.json (npm only honors overrides from the root file):
{
"overrides": {
"sharp": ">=0.35.5"
}
}
A warning from npm documentation: if sharp is also a direct dependency in your package.json, the override must match that dependency’s specification or npm throws an EOVERRIDE error. In that case, just bump the dependency version directly.
This temporary solution covers only CVE-2026-96889. It doesn’t work for the use cache RCE or the Server Actions DoS, which have no workaround beyond updating.
Is there a patch for Next.js 13 or 14?
As of this note’s publication (October 17, 2026), no. The advisories only list fixes in 15.5.28 and 16.4.1, while the image RCE reaches back to 10.0.0 and the DoS back to 13.0.0. If you’re on 13.x or 14.x, you can close the image RCE with the sharp pin described above; closing the DoS requires moving to 15.5.28 or later. If you’ve been putting off the migration to Next.js 15, this release is a good reason to set a date.
Why did it come outside the normal schedule?
Vercel announced the update a week in advance: two of the fixes had been delayed from September’s security release while upstream dependencies caught up. The researchers came through Vercel’s Open Source Bug Bounty program on HackerOne.
What about you? How long does your team typically take to deploy a critical security patch like this from the time it’s published?
- Next.js 16
- Next.js 15
- Next.js 14 or earlier
- Another situation (tell us which)
Comment below or, if this article reached you by email, reply directly to the email: your response gets published here.