VULNpocalypse
CriticalVulnerabilityPatch available

Next.js October 2026 security release: two critical RCEs, and check your sharp version

Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.

Published
Updated
Fixed in
Next.js 16.4.1, 15.5.28; sharp 0.35.5; react-server-dom-* 19.0.9, 19.1.10, 19.2.9, 19.3.1
Exploitation
None reported. CISA rates the underlying librsvg flaw as having a public proof of concept

Live scores

CVE-2026-96889
EPSS
0.006
low predicted chance of attack
VEDAS
0.246
little exploit evidence
On CISA KEV
Not listed
Detection rule
Out of scope (local)
EPSS (chance of attack)
100.1CVE-2026-96889 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-96889 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

What happened

Next.js pre-announced an out-of-band release on 8 October and shipped it on 14 October 2026, as 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). Two of the fixes had been held back from the September release while upstream projects coordinated (Next.js announcement; Next.js).

  • RCE through SVG in Image Optimization (CVE-2026-96889, GHSA-2464-fhr4-w9xw, CVSS 9.5, critical). A memory bug in an upstream library used for Image Optimization can lead to unauthenticated code execution when Next.js runs on glibc-based Linux. It affects Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 (GHSA). The Next.js advisory does not name the library. The CVE record does: Red Hat published CVE-2026-96889 on 23 September 2026 as a use-after-free in librsvg when an SVG uses nested XML includes with duplicate entities (CVE-2026-96889).
  • RCE in use cache functions (GHSA-673q-mjm6-r5xr, CVSS 9.5, critical, no CVE). Apps using the App Router with Cache Components can be exploited without authentication when a use cache function returns multiple typed arrays. It affects 16.0.0 through 16.4.0. Next.js says there is no workaround, and to upgrade “even if your application does not have similar functions” (GHSA). The root cause is in React Server Components (GHSA-xqc2-xf4c-x3h3), fixed in react-server-dom-* 19.0.9, 19.1.10, 19.2.9 and 19.3.1 (React GHSA).
  • Denial of service through Server Actions (GHSA-p3m5-59mp-jv5r, CVSS 8.2, high, no CVE). Crafted requests to an App Router app with at least one Server Action can pin the CPU and block other requests in that process. It affects 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. Pages Router apps, and apps without Server Actions, are not affected (GHSA; Next.js).

Am I affected?

  • Image Optimization RCE: you self-host Next.js on glibc Linux (Debian, Ubuntu, RHEL, most node:* images that are not Alpine) and use Image Optimization, which is what next/image does by default. The advisory’s title says SVG files must be involved. It does not say whether the default images.dangerouslyAllowSVG: false setting protects you, so do not rely on it.
  • use cache RCE: you are on Next.js 16 and use Cache Components.
  • DoS: you use the App Router and have at least one Server Action.
bash
# Next.js and sharp as your lockfile resolves them
npm ls next sharp
pnpm why sharp
yarn why sharp

# Installed versions, from your app directory
node -p "require('next/package.json').version"
node -p "require('sharp/package.json').version"

# The same check inside the image you deployed (run where your app lives)
docker run --rm --entrypoint node your-image:tag -p "require('sharp/package.json').version"

# glibc or musl? glibc prints "GNU libc" or "GLIBC"; Alpine prints "musl"
docker run --rm --entrypoint sh your-image:tag -c 'ldd --version 2>&1 | head -1'

# Any use cache functions in your code?
grep -rn --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' "use cache" app src 2>/dev/null

What to do now

  1. Upgrade Next.js to the patched release for your line, or later: npm install next@16.4.1 for 16.x, npm install next@15.5.28 for 15.x (Next.js).
  2. Make sure sharp is 0.35.5 or later. If npm ls sharp shows anything older, run npm install sharp@^0.35.5, or pin it with overrides in package.json (resolutions for Yarn, pnpm.overrides for pnpm). Next.js gives sharp 0.35.5 as the workaround for CVE-2026-96889 (GHSA).
  3. On Next.js 14, or 15.0 to 15.4, there is no patched release. Move to 15.5.28. Until then, force sharp 0.35.5. Switching off Image Optimization (images: { unoptimized: true } in next.config) also keeps requests away from sharp. That stopgap is our suggestion, not the advisory’s.
  4. Patch the system library too, if sharp uses it. The CVE lists fixed librsvg2 packages for Red Hat Enterprise Linux (CVE-2026-96889). If your sharp links against a system-wide libvips instead of its bundled one, update your distribution’s librsvg.
  5. Rebuild and redeploy every image. The fix is in your node_modules, so an image built before 14 October still carries the old code.
  6. Update the React server packages if you use React Server Components outside Next.js, for example with React Router, Waku or the Vite RSC plugin (React GHSA).

No exploitation has been reported. CISA’s enrichment of the CVE record marks exploitation of CVE-2026-96889 as “poc”, meaning a proof of concept exists (CVE-2026-96889).

Why this is part of the Vulnpocalypse

The worst bug in this release is not in Next.js. It is in librsvg, an SVG library reached through sharp and libvips, three layers below the code most Next.js developers read. The CVE was public on 23 September, three weeks before Next.js could ship its fix, because the fix had to travel up that chain first (CVE-2026-96889; Next.js announcement).

It is also the second unauthenticated RCE in React Server Components in under a year, after React2Shell. The lesson for developers: track native and transitive dependencies, not just the framework version, and check what the lockfile actually resolves after every security bump.

Sources