next.js ships an out-of-band fix for two critical rce bugs

what happened

• On October 14, 2026, Next.js released out-of-band updates v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS), including two fixes held back from the September security release because of upstream dependency delays.[1]
• GHSA-673q-mjm6-r5xr allows unauthenticated remote code execution in App Router apps that use Cache Components when a "use cache" function returns multiple typed arrays. It affects 16.0.0–16.4.0, scores 9.5 (CVSS v4.0) and has no known workaround.[1,3]
• CVE-2026-96889 is a memory-related bug in an upstream library used by Image Optimization that can lead to remote code execution when Next.js runs on glibc-based Linux and SVG files are used. Vercel's advisory lists affected ranges >= 10.0.0 <= 15.5.27 and > 16.0.0 <= 16.4.0 and scores it 9.5 (CVSS v4.0).[1,2]
• The interim workaround for CVE-2026-96889 is to make sure Next.js uses sharp 0.35.5 or later.[1,2]
• The same release fixes a high-severity denial-of-service flaw in App Router apps that use Server Actions (GHSA-p3m5-59mp-jv5r).[1]
• Singapore's Cyber Security Agency issued an alert on October 20, 2026 advising users to update immediately.[4]
• Netlify advised upgrading and redeploying, and manually deleting publicly available deploy previews and branch deploys, which can stay vulnerable until automatic deletion removes them.[5]