Next.js fixes two critical RCE flaws: update to 16.4.1 or 15.5.28

The Next.js team shipped an out-of-band security update on October 14, 2026. Versions 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS) fix two critical flaws that can let an attacker run code on the server without logging in, plus a high-severity denial-of-service bug. “Please patch your Next.js dependencies,” the team writes. Two of the fixes had been held back from the September security release because of delays in upstream dependencies.

What was fixed

Advisory	Severity	Who is affected
GHSA-673q-mjm6-r5xr: code execution in use cache functions that return multiple typed arrays	Critical	App Router apps using Cache Components
CVE-2026-96889 / GHSA-2464-fhr4-w9xw: code execution in the Image Optimization API with SVG files	Critical	Apps on glibc-based Linux, through the sharp image library
GHSA-p3m5-59mp-jv5r: CPU exhaustion through crafted requests	High	App Router apps with at least one Server Action

For the use cache flaw, Next.js says “there is no known workaround” and tells everyone to upgrade, even apps without such functions. For the image flaw, the workaround is to make sure Next.js uses sharp 0.35.5 or later; upgrading Next.js pulls in a fixed sharp automatically. Apps on the Pages Router, or without Server Actions, are not exposed to the denial-of-service bug. Two of the advisories have related React advisories.

What it means on hosting platforms

Netlify’s notice says sites there are affected by the use cache flaw if they meet the conditions. Its Image CDN serves next/image, so that path is not exercised on Netlify, but the same SVG flaw can be reached through next/og image responses, where Netlify says the impact is a crashed function call rather than code execution. Netlify warns that attacks on the SVG or denial-of-service bugs could still raise function costs, and that old deploy previews and branch deploys may stay vulnerable until they are deleted.

The Next.js post does not say whether Vercel or other hosts block these attacks at the edge, so treat upgrading as the fix wherever your app runs.

What to do

1. Run npm install next@16.4.1 (or next@15.5.28 on the 15.5 line).
2. Check that sharp resolves to 0.35.5 or later.
3. Redeploy, and delete old preview deployments you no longer need.

If you are choosing where to run a Next.js app, our VPS and app hosting comparison lists current plans and prices.