Critical Next.js Vulnerabilities Allow Hackers to Execute Malicious Code Remotely

Next.js has released security updates for two critical vulnerabilities that could let remote attackers run malicious code without logging in. A third, high-severity flaw could stop affected applications from serving requests.

The issues involve cached functions, SVG image processing, and Server Actions, with fixes available in Next.js 16.4.1 and 15.5.28. Published on October 14, 2026, the advisories describe separate attack paths with different requirements

Both remote code execution flaws score 9.5, while the denial-of-service issue scores 8.2. Application settings and enabled features determine exposure, so version checks are only one part of risk assessment.

The first vulnerability, tracked as GHSA-673q-mjm6-r5xr, affects App Router applications using Cache Components. An application becomes vulnerable when a use cache function returns multiple typed arrays. Under these conditions, attackers could achieve remote code execution without authentication or user interaction.

Next.js releases 16.0.0–16.4.0 are affected by the flaw, which is fixed in version 16.4.1. Developers should upgrade immediately, as no workaround or CVE identifier is available.

Critical Next.js Vulnerabilities

Earlier React and Next.js RCE reports highlight server-side risks, but the newly disclosed cache flaw has a separate trigger and is unrelated to React2Shell.

The second flaw, CVE-2026-96889, involves a memory-related weakness in an upstream library the Image Optimization API uses to handle SVG files. It can lead to remote code execution on Next.js deployments running on glibc-based Linux. The advisory lists no required privileges or user interaction.

The official image optimization advisory lists affected versions as 10.0.0 through 15.5.27 and versions above 16.0.0 through 16.4.0.

Developers can address this issue by ensuring Next.js uses sharp 0.35.5 or later. Installing the patched Next.js releases ensures package managers provide a fixed dependency.

The third vulnerability, GHSA-p3m5-59mp-jv5r, affects App Router applications with at least one Server Action. Crafted requests can drive excessive CPU usage, preventing the same process from handling further requests. Applications using Pages Router, or those without Server Actions, are not vulnerable.

Affected versions include 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0. There is no workaround besides upgrading. Previous coverage of Next.js security patches highlights related feature-specific risks, but those earlier fixes do not replace this update.

Developers should install Next.js 15.5.28 or 16.4.1 as appropriate. Updating only sharp addresses the image flaw, not the separate cached-function or Server Actions vulnerabilities.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.