Next.js patches critical RCE flaws in caching and SVG handling

Vercel released an urgent out-of-band security update for Next.js on October 14, addressing two critical remote code execution (RCE) vulnerabilities and one high-severity denial-of-service (DoS) flaw. The patches are available in Next.js versions 16.4.1 and 15.5.28, targeting applications that use React Server Components, SVG image processing, or Server Actions. While no active exploits have been reported yet, the severity of these issues demands immediate attention from development teams.

What happened

The update resolves three distinct security issues that expose Next.js applications to unauthenticated attacks. Vercel assigned a CVSS score of 9.5 to both RCE flaws, indicating they are critical and easily exploitable under specific conditions. The first vulnerability exists within React Server Components, specifically affecting apps using the use cache feature. The second involves a memory corruption bug in librsvg, an open-source library used by the sharp package for SVG rendering. The third issue is a DoS vulnerability linked to Server Actions, which allows attackers to exhaust server CPU resources with crafted requests.

These flaws affect a wide range of Next.js versions. The RCE via use cache impacts Next.js 16.0.0 through 16.4.0. The SVG-related RCE affects versions 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. The DoS flaw spans versions 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. Vercel recommends that all users upgrade to the latest patch releases, even if they believe their specific configuration is not vulnerable, to ensure comprehensive protection.

Exposure varies by hosting environment and application setup. For instance, Netlify stated that its platform does not execute the image-optimizer code path, limiting the impact of the SVG flaw on their infrastructure. However, they still advise upgrading. Applications running on glibc-based Linux systems are particularly at risk for the SVG vulnerability, as the underlying memory bug in librsvg can be triggered remotely when processing attacker-supplied files.

How it works

The React Server Components flaw triggers in rare cases where a use cache function returns more than one typed array containing an attacker-controlled value. This issue resides in the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages. When these conditions are met, the server may execute arbitrary code provided by the attacker. Although Vercel describes the scenario as extremely rare, the potential impact is severe enough to warrant a universal upgrade recommendation for Next.js 16 users.

The SVG vulnerability stems from a memory bug in librsvg, versioned as CVE-2026-96889. Next.js accesses this library through the sharp image processing package. By default, Next.js does not optimize SVGs, but enabling the dangerouslyAllowSVG setting or using the next/og feature for social preview images exposes the application to this risk. When a malicious SVG is processed on a glibc-based Linux system, the memory corruption can lead to remote code execution. This is the third image-processing RCE in Next.js since August, highlighting the risks inherent in complex native dependencies.

The DoS vulnerability affects App Router applications that define at least one Server Action. Attackers can send specially crafted requests that force a single server process to consume 100% of its CPU capacity, preventing it from handling other legitimate requests. This effectively takes the application offline for users relying on that specific process. Pages Router applications and those without Server Actions are not affected by this particular flaw.

Key details

• Fixed versions: Next.js 16.4.1 and 15.5.28 resolve all three issues.
• Sharp dependency: Version 16.4.1 automatically requires sharp 0.35.5, which contains the patched librsvg. Version 15.5.28 may still allow older, vulnerable sharp versions, requiring manual verification.
• Linux specificity: The SVG RCE is primarily exploitable on glibc-based Linux systems where Next.js processes SVGs via sharp.
• No CVE for some flaws: As of October 15, the use cache and Server Actions advisories did not have assigned CVEs and were not visible in standard npm audit feeds.
• Workarounds: There are no workarounds for the use cache and Server Actions flaws. For the SVG issue, users can block SVG rendering in sharp if they cannot upgrade immediately.
• Previous incidents: This follows similar RCE flaws in August (libheif) and September (next/og), indicating a pattern of vulnerabilities in image processing dependencies.

Why it matters

For engineering teams, this update underscores the fragility of supply chain security in modern web frameworks. The recurrence of RCE flaws in image processing libraries like sharp and its dependencies suggests that native code integration remains a high-risk area. Developers often assume that high-level framework abstractions protect them from low-level memory errors, but this incident proves that deep dependencies can introduce critical vulnerabilities that are difficult to detect without specialized scanning tools.

The lack of CVEs for two of the three flaws also highlights a gap in automated security monitoring. Many teams rely on npm audit or similar tools to flag vulnerable dependencies. Since these specific advisories were not immediately populated in standard feeds, organizations depending solely on automated scanners might have missed the urgency of the use cache and Server Actions fixes. This necessitates a more proactive approach to monitoring official framework channels and security bulletins rather than relying exclusively on automated tooling.

What you can do

• Upgrade immediately to Next.js 16.4.1 or 15.5.28 and rebuild your application.
• If using Next.js 15, manually verify that sharp is updated to version 0.35.5 or later using npm ls sharp.
• Check if your application uses dangerouslyAllowSVG or next/og and consider disabling these features if they are not essential.
• Monitor server CPU usage for unusual spikes that might indicate exploitation of the Server Actions DoS flaw.
• Review your dependency scanning pipeline to ensure it captures advisories that may not yet have assigned CVEs.
• If an immediate upgrade is not possible, block SVG operations in sharp using sharp.block({ operation: ["VipsForeignLoadSvg"] }) as a temporary mitigation for the image flaw.