pwn.watch: Next.js incident updates

[critical] Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)

Thu, 22 Oct 2026 16:00:43 GMT

On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.

Status: live · Patch: patched · Fixed in: next 15.5.28, next 16.4.1, sharp 0.35.5 (librsvg 2.63.2)

Latest updates:

2026-10-22: GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions. (source)
2026-10-14: Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features. (source)
2026-10-14: Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution. (source)

CVEs: CVE-2026-96889

[high] Next.js / React Server Components May 2026 security release

Fri, 08 May 2026 00:00:00 GMT

Coordinated May 6–7 2026 security release for React Server Components (CVE-2026-23870 DoS) and multiple Next.js advisories spanning middleware/proxy bypass, XSS, SSRF, cache poisoning and DoS. Upgrade Next.js to 15.5.18 or 16.2.6; react-server-dom-* to 19.0.6 / 19.1.7 / 19.2.6. Next.js 13.x/14.x had no planned patches.

Status: closed · Patch: patched · Fixed in: Next.js 15.5.18, Next.js 16.2.6, react-server-dom-* 19.0.6 / 19.1.7 / 19.2.6

CVEs: CVE-2026-23870

[high] React Server Components DoS CVE-2026-23869 (April Next.js advisory)

Wed, 08 Apr 2026 00:00:00 GMT

April 8 2026 Next.js advisory GHSA-q4gf-8mx6-v5v3 tracks upstream CVE-2026-23869: crafted requests to App Router Server Function endpoints can cause excessive CPU / DoS. Patched in Next.js 15.5.15 and 16.2.3.

Status: closed · Patch: patched · Fixed in: 15.5.15, 16.2.3

CVEs: CVE-2026-23869

[critical] React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js

Fri, 12 Dec 2025 00:00:00 GMT

A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.

Status: closed · Patch: patched · Fixed in: React 19.0.1, React 19.1.2, React 19.2.1, Next.js: patched release lines per the React/Next.js advisory

Latest updates:

2025-12-12: Unit 42 updates its threat brief on ongoing exploitation (source)
2025-12-05: CISA adds CVE-2025-55182 to KEV
2025-12-03: React discloses a critical vulnerability in React Server Components and ships fixes (source)

CVEs: CVE-2025-55182

[critical] Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)

Sat, 22 Mar 2025 00:00:00 GMT

Sending a crafted x-middleware-subrequest header made self-hosted Next.js skip middleware entirely, bypassing auth checks done there. Apps hosted on Vercel were protected. Fixed in 12.3.5, 13.5.9, 14.2.25 and 15.2.3; otherwise strip the header at the edge.

Status: closed · Patch: patched · Fixed in: 12.3.5, 13.5.9, 14.2.25, 15.2.3

Latest updates:

2025-03-22: Vercel publishes a postmortem on the bypass and its disclosure handling (source)
2025-03-21: Next.js publishes advisory GHSA-f82v-jwr5-mffw (source)

CVEs: CVE-2025-29927