# Next.js Releases Urgent Update to Address Critical Security Vulnerabilities

*Published October 16, 2026*
*Source: [https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html](https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/next-js-releases-urgent-update-to-address-critical-security-vulnerabilities) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Next.js has issued an urgent security update on October 14 to address two critical vulnerabilities that allow unauthenticated remote code execution, alongside a high-severity denial-of-service issue. These vulnerabilities impact components within React Server and librsvg, an open-source library utilized by Next.js for handling SVG images through the sharp package. The vulnerabilities have been resolved in Next.js versions 16.4.1 and 15.5.28, which are part of the current long-term support releases. Vercel, the developer of Next.js, identified both code execution flaws as critical, assigning them a CVSS score of 9.5. The first flaw is associated with React Server Components, specifically affecting the use cache function that returns multiple typed arrays. Although this affects a limited number of cases, Vercel advises upgrading even if such functions are not in use. The second flaw is a memory bug in the librsvg library, which could result in code execution when Next.js operates on glibc-based Linux systems. By default, Next.js does not optimize SVG files, but the vulnerability can be exploited if the dangerouslyAllowSVG setting is enabled. Next.js apps using the next/og feature for building social-preview images are also potentially vulnerable. The third issue is a denial-of-service vulnerability within App Router apps that use Server Actions, which could lead to excessive CPU usage. While the impact varies by hosting environment, all users are advised to upgrade to the latest Next.js versions and rebuild their applications. Vercel's advisory assures that upgrading Next.js should automatically update the sharp package to its fixed version. However, users on version 15 should verify that sharp is updated to version 0.35.5 or later. If immediate upgrading is not feasible, users can mitigate the image flaw by updating sharp or blocking SVG rendering. Users should note that the use cache and Server Actions vulnerabilities have no workaround other than upgrading. Currently, there are no public reports of these vulnerabilities being exploited in the wild.