Next.js 16.4.1 and 15.5.28 Fix Two Critical RCEs and a DoS

Next.js Lines and Fixed Versions for the Three October Flaws #

The three advisories cover different version ranges. The 'use cache' flaw exists only on 16.x, the Server Actions denial of service starts at 13.0.0, and the image optimization flaw starts at 10.0.0. The table shows which flaw reaches which line and what to install now, after the November releases.

Vercel calls 16.4 the Active LTS line and 15.5 the Maintenance LTS line, and the October and November security releases ship only for those two lines. An application on 13.x or 14.x that uses the App Router with a Server Action has no fix for the denial of service except moving to 15.5 or 16.4. The security post adds that two of the three fixes, one critical and one high, were held back from the September 30 security release because of upstream dependency delays.

Remote Code Execution Through 'use cache' Functions on Next.js 16 #

GHSA-673q-mjm6-r5xr is rated critical with a CVSS 4.0 score of 9.5 and affects Next.js from 16.0.0 up to and including 16.4.0. It needs the App Router with Cache Components and a 'use cache' function that returns multiple typed arrays. The advisory lists no 15.x range, so 15.5.28 does not fix this flaw: 15.x was never affected. The advisory gives no workaround and tells every 16.x application to upgrade, including those without such a function.

The root cause is in React. The upstream advisory, GHSA-xqc2-xf4c-x3h3, received CVE-2026-126187 on November 10, 27 days after the patch, with CVSS 4.0 9.5 and the weakness CWE-502, deserialization of untrusted data. It affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack in 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0, and is fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1.

"This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value." (React advisory GHSA-xqc2-xf4c-x3h3)

The React advisory therefore reaches beyond Next.js. Any framework, bundler or bundler plugin that supports React Server Components and installs one of those three packages needs the React update. React states that an application whose React code does not use a server is not affected.

Image Optimization RCE Through librsvg on glibc Linux #

GHSA-2464-fhr4-w9xw is also critical at CVSS 4.0 9.5. It affects Next.js from 10.0.0 up to and including 15.5.27 and 16.x up to and including 16.4.0, and only when Next.js runs on glibc-based Linux and the Image Optimization API processes SVG. The flaw is not in Next.js code: the advisory names a memory-related vulnerability in an upstream library used for Image Optimization and carries CVE-2026-96889. That record describes a use-after-free in librsvg, the SVG library.

According to the record, an SVG with nested XML inclusions (XIncludes) and duplicate entity declarations makes librsvg free an XML entity the parser is still using, which can crash the process or execute arbitrary code. Red Hat published the record on September 23 with a CVSS 3.1 score of 7.8 for librsvg itself, and CISA's SSVC assessment of September 25 rates exploitation as "poc", meaning a public proof of concept. Next.js scores its own exposure through the image API higher, at 9.5.

The workaround is to make sure the sharp package used by Next.js is 0.35.5 or later. The advisory says fresh installs already get a fixed sharp and that upgrading Next.js makes package managers provide one. Because Next.js 10 to 14 get no release, an existing lockfile on those lines can keep an older sharp until someone updates it. The November release also closed a related gap: GHSA-7qx7-33qx-rqx2 (CVE-2026-119347) let an image that is misclassified as AVIF reach the SVG decoder even with images.dangerouslyAllowSVG: false.

Server Actions Denial of Service From Next.js 13 #

GHSA-p3m5-59mp-jv5r is rated high with a CVSS 4.0 score of 8.2 and affects Next.js from 13.0.0 up to and including 15.5.27 and from 16.0.0 up to and including 16.4.0. Crafted requests to an App Router application with at least one Server Action cause excessive CPU use, which blocks further requests in the same process. Applications that use only the Pages Router, or that have no Server Action, are not vulnerable. The advisory names no workaround besides upgrading.

The upstream React advisory GHSA-h3gv-c5rc-p453, also high at 8.2, describes the same class of request against Server Function endpoints, which can lead to out-of-memory exceptions as well as CPU exhaustion. It is fixed in the same React releases, 19.0.9, 19.1.10, 19.2.9 and 19.3.1, and lists no CVE.

Advisories Fixed Since: Next.js 16.4.5 and 15.5.29 #

On November 3, the November security release shipped 16.4.5 with seven advisory fixes and 15.5.29 with the three that reach 15.x. Each has a CVE and a CVSS 4.0 score between 6.0 and 6.9, and the advisories rate all seven medium. The post rates the cross-tenant disclosure, GHSA-mfr8-8qww-v76h, High. Four concern Cache Components and exist only on 16.x.

Next.js 16.4.6, released on November 9, backports bug fixes and lists no security fix, so 16.4.5 and 16.4.6 are both outside every range above.

Projects Still Older Than the September 30 Release #

The September 30 release, 16.3.8 and 15.5.27, fixed seven further advisories. A project that has not updated since before it also lacks these fixes:

• GHSA-cjq9-62q9-8jv4 (CVE-2026-94483, high, CVSS 4.0 8.3): server-side request forgery in Image Optimization through an allow-listed remote URL; applications without images.remotePatterns are not affected.
• GHSA-4jqv-mc3x-m676 (CVE-2026-94543, medium, 6.3): cache poisoning of SSG and ISR pages in self-hosted Pages Router applications; Vercel deployments are not affected.
• GHSA-mcj8-r9mp-w47p (CVE-2026-94484, medium, 6.3): one unauthenticated request can poison the shared response cache when a root-level catch-all page sits beside SSG or ISR routes.
• GHSA-f87g-xv8r-7p7x (CVE-2026-94485, medium, 6.3): metadata image routes in webpack builds ignore dynamicParams; Turbopack builds are not affected.
• GHSA-h694-7cp9-m8p3 (CVE-2026-103004, medium, 6.3): nested 'use cache' functions keyed without a root param, fixed in 16.3.8.
• GHSA-3w37-wq28-93x7 (CVE-2026-94544, medium, 6.3): unpublished Draft Mode content leaking into regular responses and prerendered pages with Cache Components.
• GHSA-39w2-rjm5-chcv (CVE-2026-94486, low, 2.3): the next dev Model Context Protocol endpoint readable by a malicious website the developer visits; production deployments do not serve it.

Upgrading Next.js, sharp and React Server Components Packages #

1. On 16.x, install next@16.4.6 or next@16.4.5; on 15.x, install next@15.5.29. Both cover the October fixes and the November ones.
2. On 13.x or 14.x with the App Router and a Server Action, plan the move to 15.5 or 16.4: the denial of service has no fix and no workaround on those lines.
3. On Next.js 10 to 14 running on glibc Linux, update sharp to 0.35.5 or later and commit the new lockfile, then confirm the version that the build resolves.
4. Outside Next.js, update react-server-dom-webpack, react-server-dom-parcel or react-server-dom-turbopack to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, whichever matches the installed 19.x line.
5. Rebuild and redeploy container images after the update, because a running image keeps the next and sharp versions it was built with.

npm install next@16.4.6        # 16.x line: 16.4.5 or later
npm install next@15.5.29       # 15.x line
npm install sharp@^0.35.5      # Next.js 10 to 14 on glibc Linux

Checking a Next.js Project for Affected Versions and Features #

The first command prints the resolved next, sharp and React Server Components packages. The second prints the glibc version on Linux and undefined on musl-based systems such as Alpine, which the image optimization flaw does not reach. The search then finds the features each advisory needs: Cache Components and 'use cache' for the 16.x flaws, a 'use server' directive for Server Actions, and the image settings for the image flaws.

npm ls next sharp react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel
node -p "process.report.getReport().header.glibcVersionRuntime"
grep -rnE "use cache|cacheComponents|use server|dangerouslyAllowSVG|remotePatterns" --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" --include="*.mjs" .