# Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache) · pwn.watch

> On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.

Page: https://pwn.watch/i/nextjs-october-2026-rce-security-release · generated 2026-10-22T19:29:07.289Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Next.js (next on npm), sharp / librsvg
- Started: 2026-10-14
- CVEs: CVE-2026-96889
- Affected: next >= 10.0.0, <= 15.5.27 (Image Optimization SVG RCE, CVE-2026-96889); next >= 16.0.0, <= 16.4.0; sharp < 0.35.5 (bundles vulnerable librsvg)
- Fixed in: next 15.5.28; next 16.4.1; sharp 0.35.5 (librsvg 2.63.2)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/nextjs-october-2026-rce-security-release/feed.xml
- JSON Feed: https://pwn.watch/i/nextjs-october-2026-rce-security-release/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nextjs-october-2026-rce-security-release.json
- This file: https://pwn.watch/i/nextjs-october-2026-rce-security-release/llms.txt

## Updates (newest first)
- 2026-10-22: GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions. (https://github.com/advisories/GHSA-2464-fhr4-w9xw)
- 2026-10-14: Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features. (https://nextjs.org/blog/nextjs-security-update-october-14-2026)
- 2026-10-14: Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution. (https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/)
- 2026-09-27: sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg). (https://github.com/advisories/GHSA-wq5f-xc86-pv6w)

## Fix brief
# Security brief: Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)

Source: https://pwn.watch/i/nextjs-october-2026-rce-security-release · status: live · severity: critical · updated Oct 22, 2026, 20:01 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.

Severity detail: CVSS 4.0 9.5 (Next.js advisory) for both RCEs; unauthenticated; no known exploitation, not in CISA KEV

- Product: Next.js (next on npm), sharp / librsvg
- CVE / advisory ids: CVE-2026-96889

## Affected versions
- next >= 10.0.0, <= 15.5.27 (Image Optimization SVG RCE, CVE-2026-96889)
- next >= 16.0.0, <= 16.4.0
- sharp < 0.35.5 (bundles vulnerable librsvg)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- next 15.5.28
- next 16.4.1
- sharp 0.35.5 (librsvg 2.63.2)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
- Upgrade `next` to 16.4.1 (16.x) or 15.5.28 (15.x), then redeploy.
- Check `npm ls sharp` resolves to 0.35.5 or later; if you can't upgrade yet, block SVG decoding with `sharp.block({ operation: ["VipsForeignLoadSvg"] })` (from sharp's advisory).
- The `use cache` RCE has no workaround: upgrade.

## Latest updates
- Oct 22, 2026: GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions.
- Oct 14, 2026: Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features.
- Oct 14, 2026: Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution.
- Sep 27, 2026: sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg).

## Advisories
- [GHSA-673q-mjm6-r5xr: Unauthenticated RCE in `use cache` functions returning typed arrays](https://github.com/advisories/GHSA-673q-mjm6-r5xr) (GitHub Advisory Database)
- [Next.js Security Update for Upstream Vulnerabilities](https://nextjs.org/blog/nextjs-security-update-october-14-2026) (Vercel)
- [GHSA-2464-fhr4-w9xw: Unauthenticated RCE in Image Optimization API when SVG files are used](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw) (Vercel)
- [GHSA-2464-fhr4-w9xw (GitHub Advisory Database)](https://github.com/advisories/GHSA-2464-fhr4-w9xw) (GitHub)
- [sharp: Vulnerability in librsvg dependency CVE-2026-96889 (GHSA-wq5f-xc86-pv6w)](https://github.com/advisories/GHSA-wq5f-xc86-pv6w) (GitHub)
- [CVE-2026-96889](https://nvd.nist.gov/vuln/detail/CVE-2026-96889) (NVD)
- [Next.js v16.4.1 release](https://github.com/vercel/next.js/releases/tag/v16.4.1) (Vercel)

## Write-ups & news
- [Next.js & React security release (Oct 2026): what to know](https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/)

## Caveats
GHSA-673q-mjm6-r5xr (use cache) was published to the GitHub Advisory Database on Oct 22 2026 as critical, affecting next >= 16.0.0, <= 16.4.0 and fixed in 16.4.1 (apps using Cache Components). Upstream React advisories: GHSA-xqc2-xf4c-x3h3 (use cache RCE), GHSA-h3gv-c5rc-p453 (Server Actions DoS).

---
Machine-readable: https://pwn.watch/i/nextjs-october-2026-rce-security-release.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.