Next.js just shipped an out-of-band security update for two critical unauthenticated remote-code-execution flaws (CVSS 9.5 each) plus a high-severity denial-of-service bug. One RCE hides in React Server Components' use cache; the other in SVG image processing via sharp/librsvg on glibc Linux. No login needed for either. Paste your Next.js version into this free CVE checker for an instant verdict. No signup.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
This cybersecurity news covers two unauthenticated remote-code-execution flaws in Next.js, both scoring CVSS 9.5. Attackers can run code on unpatched servers without logging in. If your Next.js version is below the patched release, upgrade immediately — public exploits typically appear within days of disclosure.
| Flaw | Affected | Fixed in | Who's exposed |
|---|---|---|---|
RCE via use cacheGHSA-673q-mjm6-r5xr CVSS 9.5 | 16.0.0 – 16.4.0 | 16.4.1 | App Router + Cache Components where a use cache fn returns multiple typed arrays. Root cause in React (react-server-dom-* 19.0.0–19.3.0). No workaround — upgrade even if you think you're unaffected. |
| RCE via SVG images CVE-2026-96889 CVSS 9.5 | 10.0.0 – 15.5.27 and 16.0.0 – 16.4.0 | 16.4.1, or 15.5.28 with sharp ≥ 0.35.5 | Apps passing attacker-supplied SVGs to sharp on glibc Linux — via dangerouslyAllowSVG or next/og on Node.js runtime. Workaround: sharp 0.35.5+ or sharp.block({operation:["VipsForeignLoadSvg"]}). |
| DoS via Server Actions GHSA-p3m5-59mp-jv5r High | 13.0.0 – 15.5.27 and 16.0.0 – 16.4.0 | 15.5.28, 16.4.1 | App Router apps with ≥1 Server Action. Crafted requests burn CPU and block the process. Pages Router apps are not affected by this one. |
As of Oct 15: no public reports of exploitation, and two of the advisories were missing from the npm audit feed — npm audit alone may not warn you. Check the version manually.
sharp automatically.sharp ≥ 0.35.5 or block SVG loads in sharp. There is no workaround for the use cache RCE — that one needs the upgrade.use cache functions returning typed arrays, check for dangerouslyAllowSVG or next/og usage, inventory your Server Actions.Drop a live version checker into your blog, docs, or forum post — three lines of HTML.
Get the embed codeThis page checked one release. BreachHunter pentests your web application's exposed surface — the outdated frameworks and misconfigurations attackers actually probe.
Next.js shipped an out-of-band update on October 14, 2026 fixing three flaws: (1) unauthenticated RCE via 'use cache' functions returning multiple typed arrays (GHSA-673q-mjm6-r5xr, CVSS 9.5) in 16.0.0–16.4.0 with Cache Components; (2) unauthenticated RCE via SVG image processing through sharp/librsvg (CVE-2026-96889, CVSS 9.5) in 10.0.0–15.5.27 and 16.0.0–16.4.0 on glibc Linux; (3) high-severity DoS via Server Actions (GHSA-p3m5-59mp-jv5r) in 13.0.0–15.5.27 and 16.0.0–16.4.0. Fixed in 16.4.1 and 15.5.28.
Run 'npm ls next' in your project, or check the version in package.json / package-lock.json. Then compare against the fixed releases: 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). The interactive checker on this page does the comparison for you — paste your version and it tells you which of the three flaws you're exposed to.
Partially: ensure sharp is 0.35.5 or later, or block SVG rendering in sharp with sharp.block({ operation: ['VipsForeignLoadSvg'] }). But the 'use cache' RCE has no workaround — Vercel recommends upgrading even if you believe your app doesn't use the affected pattern. No public exploitation had been reported as of October 15, 2026.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.