Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)
Next.js (next on npm), sharp / librsvg
On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.
Why this severity: CVSS 4.0 9.5 (Next.js advisory) for both RCEs; unauthenticated; no known exploitation, not in CISA KEV
- Started
- Oct 14, 2026
Affected
- next >= 10.0.0, <= 15.5.27 (Image Optimization SVG RCE, CVE-2026-96889)
- next >= 16.0.0, <= 16.4.0
- sharp < 0.35.5 (bundles vulnerable librsvg)
Fixed in
- next 15.5.28
- next 16.4.1
- sharp 0.35.5 (librsvg 2.63.2)
Timeline4
GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions.
SourceVercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features.
SourceNetlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution.
Sourcesharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg).
Source
Advisories6
- Next.js Security Update for Upstream VulnerabilitiesVercel · Oct 14, 2026
- GHSA-2464-fhr4-w9xw: Unauthenticated RCE in Image Optimization API when SVG files are usedVercel · Oct 14, 2026
- GHSA-2464-fhr4-w9xw (GitHub Advisory Database)GitHub · Oct 22, 2026
- sharp: Vulnerability in librsvg dependency CVE-2026-96889 (GHSA-wq5f-xc86-pv6w)GitHub · Sep 30, 2026
- CVE-2026-96889NVD · Sep 23, 2026
- Next.js v16.4.1 releaseVercel · Oct 14, 2026
Posts2
‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS. RCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889). 🔗 Read - t.co/ndnN46ysGv
🚨 CRITICAL: CVE-2026-96889 — Next.js Image Optimization RCE via SVG (librsvg/sharp) Score 9.5 (CVSS 4.0, Next.js advisory). Unauthenticated. Glibc Linux. Affects Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0. Fixed in 15.5.28 and 16.4.1. Check npm ls sharp → 0.35.5+. Not in CISA
Notes & caveats
GHSA-673q-mjm6-r5xr (use cache) is listed in the Next.js release notes and blog but its advisory page was not publicly readable at check time, so its affected range is taken from Vercel's blog and Netlify (16.x apps using Cache Components). Upstream React advisories: GHSA-xqc2-xf4c-x3h3 (use cache RCE), GHSA-h3gv-c5rc-p453 (Server Actions DoS).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
