Security incidents tagged Next.js. Newest first.
On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.
Next.js (next on npm), sharp / librsvgSince Oct 14, 2026
Next.js; react-server-dom-webpack/parcel/turbopack Patched
Coordinated May 6–7 2026 security release for React Server Components (CVE-2026-23870 DoS) and multiple Next.js advisories spanning middleware/proxy bypass, XSS, SSRF, cache poisoning and DoS. Upgrade Next.js to 15.5.18 or 16.2.6; react-server-dom-* to 19.0.6 / 19.1.7 / 19.2.6. Next.js 13.x/14.x had no planned patches.
Next.js App Router / React Server Components Patched
April 8 2026 Next.js advisory GHSA-q4gf-8mx6-v5v3 tracks upstream CVE-2026-23869: crafted requests to App Router Server Function endpoints can cause excessive CPU / DoS. Patched in Next.js 15.5.15 and 16.2.3.
A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.
React Server Components (react-server-dom-*), Next.jsClosed Dec 12, 2025
Next.js (self-hosted) Patched
Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.
‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS. RCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889). 🔗 Read - t.co/ndnN46ysGv
🚨 CRITICAL: CVE-2026-96889 — Next.js Image Optimization RCE via SVG (librsvg/sharp) Score 9.5 (CVSS 4.0, Next.js advisory). Unauthenticated. Glibc Linux. Affects Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0. Fixed in 15.5.28 and 16.4.1. Check npm ls sharp → 0.35.5+. Not in CISA
