Vercel has shipped the out-of-band patch it warned about last week. The October 14 Next.js security update fixes two critical unauthenticated remote code execution bugs and one high-severity denial-of-service bug. If you run Next.js 16.4 or 15.5 in production, plan to upgrade today. The rest of this article covers who is exposed and what to check after you upgrade.
Why this release came late
The fixes didn't come out of nowhere. Last week the Next.js team pre-announced an out-of-band update. That update included two fixes held back from the September security release because upstream dependencies weren't ready. The post title says "upstream vulnerabilities" because two of the three issues have matching advisories in React, and the third comes from a library that sharp uses for image processing.
Patches are available for exactly two release lines:
- v16.4.1 (Active LTS)
- v15.5.28 (Maintenance LTS)
The announcement doesn't mention any other line. If you're on 16.3, 15.4, 14.x or older, you'll need to move to one of these two lines to get the fixes.
The three vulnerabilities
RCE in use cache functions that return typed arrays (critical)
This one affects App Router apps with Cache Components turned on. It's tracked as GHSA-673q-mjm6-r5xr, and the upstream React advisory is GHSA-xqc2-xf4c-x3h3. The trigger is a use cache function that returns multiple typed arrays. Here's a pattern that matches that description:
1// app/lib/telemetry.ts
2'use cache'
3
4export async function getSeries(id: string) {
5 const res = await fetch(`https://api.example.com/series/${id}`)
6 const buf = await res.arrayBuffer()
7 // Returning more than one typed array from a cached function
8 return {
9 timestamps: new Float64Array(buf, 0, 512),
10 values: new Float32Array(buf, 4096, 512),
11 }
12}Don't assume you're safe just because you can't find code like this. The advisory is explicit:
"There is no known workaround for affected applications. You should upgrade immediately even if your application does not have similar functions."
— Next.js team, October 14 security update
The post doesn't explain why apps without such functions are still told to upgrade. Treat that as a signal that grepping your code base isn't a reliable way to rule yourself out.
RCE in the Image Optimization API via SVG (critical)
This is CVE-2026-96889 / GHSA-2464-fhr4-w9xw. It's a memory bug in a library that Next.js uses for image optimization. It can lead to RCE when Next.js runs on glibc-based Linux. Dependabot-driven pull requests from early October, like this one, name the bug as a librsvg flaw bundled with sharp 0.35.4 and fixed in sharp 0.35.5 under advisory GHSA-wq5f-xc86-pv6w. So the sharp fix was public about a week before Next.js shipped.
This bug is the only one of the three with a workaround: make sure the sharp that Next.js resolves is 0.35.5 or later. If you upgrade Next.js to the patched versions, your package manager pulls in a fixed sharp automatically.
Most self-hosted Docker images run glibc-based Linux. That includes Debian-based node and node:*-slim images and most Ubuntu hosts. Alpine uses musl, which falls outside the advisory's stated scope. That's a fact about your base image, not a guarantee, and it's no reason to skip the patch.
DoS via Server Actions (high)
GHSA-p3m5-59mp-jv5r, with React counterpart GHSA-h3gv-c5rc-p453, lets crafted requests drive CPU usage high enough to block the Node process. One request can starve every other request handled by the same process. You're affected if you use App Router with at least one Server Action. Pages Router apps, and App Router apps with no Server Actions, are not vulnerable to this one.
How to upgrade
Upgrade within your current major version:
1# Next.js 16.4
2npm install next@16.4.1
3
4# Next.js 15.5
5npm install next@15.5.28With pnpm or Yarn, use pnpm add next@16.4.1 or yarn add next@16.4.1. Commit the lockfile and redeploy. Updating package.json without rebuilding and redeploying changes nothing in production.
Advertisement
Next, check which sharp actually got installed. A monorepo can end up with more than one copy, and a direct sharp dependency pinned to an exact older version won't move on its own:
1npm ls sharp
2# or
3pnpm why sharpEvery copy should show 0.35.5 or later. If you can't upgrade Next.js right away, force sharp forward with an override. That covers the image bug only, not the other two:
1{
2 "overrides": {
3 "sharp": "^0.35.5"
4 }
5}pnpm uses "pnpm": { "overrides": { ... } } and Yarn uses "resolutions". Remove the override once you're on a patched Next.js release so it doesn't pin you later.
No application code changes are needed. None of the advisories describe API changes, and both are patch releases.
Am I exposed? A quick triage
You can use the scope details to decide what to fix first. They don't change whether you should upgrade.
- Cache Components enabled? If next.config.ts turns on Cache Components and you use 'use cache', treat the first bug as critical, whatever your return types are.
- Any Server Actions? Search for 'use server'. One match in an App Router project puts you in scope for the DoS.
- Does your image optimizer handle SVG? By default, Next.js won't optimize SVGs unless you set images.dangerouslyAllowSVG. One project's security PR used exactly this argument to decide it wasn't exposed in practice. The official advisory doesn't make that claim, though, so don't lean on it.
1// next.config.ts — if you see this, prioritize the image fix
2import type { NextConfig } from 'next'
3
4const config: NextConfig = {
5 images: {
6 dangerouslyAllowSVG: true,
7 },
8}
9
10export default configIf you answered no to all three, you can probably wait for your next deploy window. Don't wait past that: these are unauthenticated RCE bugs in a widely deployed framework, and the details are now public.
Beyond Next.js
Two of these bugs come from React, and a Next.js upgrade only protects Next.js apps. The fixes sit in React's Server Components layer. If you use Server Components or Server Functions in another framework or bundler integration, read the two React advisories linked above. Update whatever versions they list, and check whether your framework has its own release. I couldn't confirm from the Next.js post which React package versions contain the fixes.
The sharp bug reaches even further. Any Node service that runs untrusted SVGs through sharp on glibc Linux is in scope, Next.js or not. That covers upload handlers, thumbnail workers and CMS image pipelines. The sharp upgrade is cheap. Do it everywhere you use it.
Some questions remain open. The announcement doesn't say whether 16.3, 15.4 or 14.x will get backports. It doesn't say whether Vercel-hosted image optimization was ever exposed. And it doesn't explain why apps with no typed-array cache functions still need the first fix. If you're on an unsupported line, don't wait for a backport. Upgrading to 15.5 or 16.4 is the only fix the team has announced.
