{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache) · updates",
  "home_page_url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release",
  "feed_url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release/feed.json",
  "description": "On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.",
  "language": "en",
  "_pwn": {
    "slug": "nextjs-october-2026-rce-security-release",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/nextjs-october-2026-rce-security-release/feed.xml",
    "llms": "https://pwn.watch/i/nextjs-october-2026-rce-security-release/llms.txt",
    "json": "https://pwn.watch/i/nextjs-october-2026-rce-security-release.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/nextjs-october-2026-rce-security-release#2026-10-22-24352cc8",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release#2026-10-22-24352cc8",
      "title": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions.",
      "content_text": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions.\n\nSource: https://github.com/advisories/GHSA-2464-fhr4-w9xw",
      "date_published": "2026-10-22T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nextjs-october-2026-rce-security-release#2026-10-14-720a17d6",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release#2026-10-14-720a17d6",
      "title": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features.",
      "content_text": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features.\n\nSource: https://nextjs.org/blog/nextjs-security-update-october-14-2026",
      "date_published": "2026-10-14T00:00:00.000Z",
      "external_url": "https://nextjs.org/blog/nextjs-security-update-october-14-2026",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nextjs-october-2026-rce-security-release#2026-10-14-98a0ec0d",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release#2026-10-14-98a0ec0d",
      "title": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution.",
      "content_text": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution.\n\nSource: https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/",
      "date_published": "2026-10-14T00:00:00.000Z",
      "external_url": "https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/nextjs-october-2026-rce-security-release#2026-09-27-1124d2b0",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release#2026-09-27-1124d2b0",
      "title": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg).",
      "content_text": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache): sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg).\n\nSource: https://github.com/advisories/GHSA-wq5f-xc86-pv6w",
      "date_published": "2026-09-27T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-wq5f-xc86-pv6w",
      "tags": [
        "critical"
      ]
    }
  ]
}