Critical Next.js Vulnerabilities Enable Remote Code Execution and Denial-of-Service
Next.js has released urgent security updates to address two critical vulnerabilities allowing unauthenticated remote code execution and a high-severity flaw enabling denial-of-service attacks.
Next.js, a popular React framework for building web applications, has issued critical security patches to mitigate two severe vulnerabilities that could permit unauthenticated remote code execution (RCE). Additionally, a separate high-severity flaw has been addressed, which could lead to denial-of-service (DoS) conditions, preventing applications from serving requests. The vulnerabilities, detailed in advisories published on October 14, 2026, affect specific functionalities within Next.js, including cache components, SVG image processing, and Server Actions.
The first critical vulnerability, identified as GHSA-673q-mjm6-r5xr, impacts applications utilizing the App Router and Cache Components. When a use cache function returns multiple typed arrays, attackers can exploit this condition to achieve RCE without requiring any authentication or user interaction. This flaw affects Next.js versions 16.0.0 through 16.4.0, with the fix available in version 16.4.1. Developers are strongly advised to upgrade immediately, as no workaround is available for this specific issue.
The second critical RCE vulnerability, tracked as CVE-2026-96889, stems from a memory-related weakness in an upstream library used by the Image Optimization API for handling SVG files. This vulnerability can lead to remote code execution on Next.js deployments running on glibc-based Linux systems. The advisory notes that no specific privileges are required, nor is user interaction necessary for exploitation. Versions 10.0.0 through 15.5.27 and versions 16.0.0 through 16.4.0 are affected. The recommended solution is to ensure Next.js is using sharp version 0.35.5 or later, which is typically managed through package updates.
A third vulnerability, GHSA-p3m5-59mp-jv5r, poses a high-severity threat, enabling denial-of-service attacks. This flaw specifically targets applications using the App Router that have at least one Server Action configured. By sending specially crafted requests, attackers can induce excessive CPU usage, rendering the application unresponsive and unable to handle further incoming requests. Applications built with the Pages Router or those without Server Actions are not susceptible to this particular vulnerability. Affected versions include 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. The only mitigation is to upgrade to the patched versions, 15.5.28 or 16.4.1.
These vulnerabilities carry significant risk, with the two RCE flaws rated at a CVSS score of 9.5, indicating a critical severity. The DoS vulnerability is rated at 8.2. The extent of exposure depends on the specific application configurations and enabled features, making a simple version check insufficient for a complete risk assessment. Developers must consider their deployment's specific setup when evaluating their vulnerability to these issues.
While previous security advisories have addressed various risks within React and Next.js, these newly disclosed vulnerabilities have distinct triggers and are unrelated to prior reported issues like React2Shell. The fix for the image processing flaw requires updating the sharp library, while the other two vulnerabilities are addressed by updating Next.js itself. It is crucial for developers to apply the appropriate updates to safeguard their applications against these threats.
Organizations utilizing Next.js are urged to prioritize these updates to prevent potential exploitation. The ability for unauthenticated attackers to execute arbitrary code or disrupt service poses a substantial risk to data integrity, application availability, and overall system security. Prompt patching is essential to maintain a secure operating environment.
The new article provides further technical detail on the vulnerabilities, specifying that one critical flaw impacts React Server Components and enables unauthenticated RCE, while the second RCE vulnerability is located within the librsvg library used for SVG processing via the sharp package. It also confirms the patching of a high-severity DoS flaw.