Vulnerabilities · Application Security
Next.js patches two critical flaws that could let attackers run code on servers
Next.js has released urgent updates to fix two critical vulnerabilities that could let attackers run code on affected servers. The flaws affect caching and SVG image processing features.
Ross GrantUpdated 3 min read
The short version
Next.js, a tool for building websites, has fixed two serious security problems. These could have let attackers take control of servers running certain Next.js features. If you use Next.js, you should update to the latest version right away to stay safe.
What happened?
Next.js released urgent security updates on 14 October 2026 to fix two critical vulnerabilities that could let attackers run code on servers. The flaws affect caching and SVG image processing features. A denial-of-service issue was also fixed. No attacks have been reported so far.
What was fixed and who is affected
Next.js, a popular web development framework, released urgent security updates on 14 October 2026 to address two critical vulnerabilities. These flaws could allow unauthenticated attackers to run code remotely on servers using certain Next.js features. The fixes are available in Next.js versions 16.4.1 and 15.5.28, which are the current long-term support releases. There is also a high-severity denial-of-service (DoS) issue fixed in the same update.
The first critical flaw is in React Server Components, a feature that runs parts of a web app on the server. The second is in the way Next.js processes SVG image files, using a library called librsvg through the sharp package. Both flaws are rated as critical, with a CVSS score of 9.5 according to Vercel, the company behind Next.js. The DoS flaw is rated high severity.
Details of the vulnerabilities
The React Server Components flaw can be triggered in rare cases where a caching function returns more than one typed array (a kind of data structure), and an attacker can control some of the data. Only apps using the Cache Components feature in version 16 are exposed, but Vercel recommends all users upgrade.
The SVG flaw is a memory bug in librsvg, which Next.js uses to process SVG images via the sharp package. This flaw can be exploited when Next.js runs on glibc-based Linux systems. By default, Next.js does not optimise SVG files, but the risk appears if the dangerouslyAllowSVG setting is enabled or if the next/og feature (for generating social preview images) is used in the Node.js runtime.
The DoS issue affects apps using the App Router with at least one Server Action. Crafted requests can push a server process to full CPU use, blocking other requests. Apps using the Pages Router or with no Server Actions are not affected.
How to protect your apps
Vercel advises upgrading to Next.js 16.4.1 (for version 16 users) or 15.5.28 (for version 15 users), then rebuilding and redeploying. The update should also bring in the fixed version of sharp (0.35.5), which patches the SVG flaw. However, on version 15, the upgrade might not automatically update sharp, so users should check their version and update sharp manually if needed.
If you cannot upgrade Next.js right away, you can reduce risk from the SVG flaw by blocking SVG rendering in sharp or ensuring sharp is at least version 0.35.5. There are no workarounds for the other two flaws; only upgrading Next.js will fix them.
Context and previous incidents
This is the third time since August that image processing in Next.js has led to a code-execution vulnerability. Previous issues involved different image formats and features, including a bug in libheif (for AVIF images) and a flaw in next/og. The underlying SVG bug (CVE-2026-96889) was first made public in September and fixed in sharp on 27 September.
Netlify, a major hosting provider, said its platform does not run the affected image-optimizer code path, so the impact is limited for its users, but it still recommends upgrading.
As of 15 October, there are no public reports of these flaws being exploited in the wild. However, the flaws are serious enough that immediate action is recommended.
What you should do
- Upgrade to the latest supported version of Next.js and sharp as soon as possible.
- If you use SVG processing, check your configuration and consider disabling SVG optimisation unless absolutely necessary.
- Review your app's use of React Server Components and Server Actions to understand your exposure.
- Monitor advisories from Vercel and related package maintainers for updates.
The Hacker News (opens in a new tab) has the full technical breakdown and timeline.
Claimed vs confirmed
- Confirmed
Next.js patched two critical remote code execution flaws and a denial-of-service issue.
The Hacker News reports that Next.js released out-of-band fixes for these issues on 14 October 2026.
- Confirmed
No attacks have been reported using these flaws.
The Hacker News states that as of 15 October, there are no public reports of exploitation.
The impact
- Money
- If attackers exploited these flaws, affected organisations could face costs from incident response, downtime, and possible regulatory fines. Under UK GDPR, fines can reach up to £17.5 million or 4% of global turnover for serious breaches.
- Reputation
- A breach through these flaws could damage trust in affected websites or services, especially if attackers gained control of servers or disrupted services.
- Customers
- Users of affected websites could have their data or interactions exposed if attackers exploited these flaws. Website owners should update Next.js and sharp to protect their users.
Why it matters
Anyone running a website or app on Next.js could be at risk if they use the affected features. Attackers could take over servers or disrupt services. Updating quickly is important to protect users and systems.
How does it work?
The first flaw lets attackers run code by exploiting a rare bug in React Server Components when a cache function returns more than one typed array. The second flaw is a memory bug in the librsvg library used for SVG image processing, which can be triggered when handling attacker-supplied SVG files. Both flaws can be exploited remotely without authentication.
Key points
- Next.js patched two critical flaws that could let attackers run code on servers.
- Both flaws affect features used in some web apps: caching and SVG image processing.
- A denial-of-service bug was also fixed in the same update.
- Immediate upgrades are recommended to protect affected apps.
- No attacks have been reported yet, but the flaws are serious.
Sources
The Hacker News
Reference
