Patch Next.js Now: Three Upstream Vulnerabilities Fixed in 16.4.1 and 15.5.28

What the advisory announces #

The Next.js Security Update for Upstream Vulnerabilities post describes an out-of-band update. It says two fixes were postponed from the September security release because of upstream dependency delays, and that the patched releases now address these issues. The post does not say which two fixes were postponed, so this article does not connect the delay to any single vulnerability.

The post asks readers to patch their Next.js dependencies. It covers three separate problems in three areas of the framework: caching, image processing, and request handling for Server Actions. Because each area is independent, checking only one feature could miss exposure in another. The safest reading is to treat the update as a change that applies to every Next.js application on the affected release lines.

The three issues in detail #

Unauthenticated RCE in use cache functions (Critical) #

The first issue is tracked as GHSA-673q-mjm6-r5xr against Next.js, with a related upstream advisory, GHSA-xqc2-xf4c-x3h3, against React. The post says that applications using the App Router with Cache Components can be affected when a use cache function returns multiple typed arrays. The stated impact is unauthenticated remote code execution.

The post states that there is no known workaround for affected applications. It also advises upgrading immediately, even if an application does not have functions similar to the vulnerable pattern. Because the condition is narrow, a team might assume it is unaffected. The post does not support that assumption as a reason to delay. The upgrade is the mitigation the post offers, and reviewing your functions helps you understand exposure rather than replacing the update.

Unauthenticated RCE in the Image Optimization API with SVG (Critical) #

The second issue is CVE-2026-96889, also listed as GHSA-2464-fhr4-w9xw. The post describes a memory-related vulnerability in an upstream library used for Image Optimization. When Next.js runs on glibc-based Linux, the post says this can lead to remote code execution. The issue is connected to SVG handling, but the post does not define the exposure boundary in more detail, so teams should not assume that other image formats are safe.

The post names a workaround: make sure the version of sharp used by Next.js is 0.35.5 or later. It also explains that upgrading Next.js to the patched versions means package managers automatically provide a fixed version of sharp to the framework. The framework upgrade is the path the post describes, and the sharp version is the condition the workaround depends on.

Denial of service through Server Actions (High) #

The third issue is GHSA-p3m5-59mp-jv5r against Next.js, with a related upstream advisory, GHSA-h3gv-c5rc-p453, against React. The post says that crafted requests targeting applications that use the App Router with at least one Server Action can cause excessive CPU usage. That CPU use blocks the processing of further requests in the same process, which produces a denial of service.

The scope is stated clearly. The post says that applications using the Pages Router are not vulnerable, and neither are applications that do not use Server Actions. A service running only Pages Router code is therefore outside the scope of this item, although the general update still applies to the framework. Teams with several services should identify which ones use the App Router with Server Actions and address those first.

Affected and fixed versions #

The table below lists only what the Next.js Security Update for Upstream Vulnerabilities post states. It names the fixed versions, gives the support status of each line, and provides npm install commands for both. It does not publish exact affected version ranges for each issue, so the table does not state them. A version that is not listed should not be treated as safe by default.

The main rule is to move to the patched release on your own line. Applications on 16.x should target 16.4.1, and applications on 15.x should target 15.5.28. The sharp row works differently. The post presents 0.35.5 as a workaround condition rather than a Next.js release, so it is a separate check from the framework upgrade.

Protection steps #

The steps below follow what the post states. They do not add tooling or settings that the post does not mention.

1. Upgrade Next.js on each release line using the commands from the advisory:

   BashCopy

   # for 15.5
   npm install next@15.5.28
   # for 16.4
   npm install next@16.4.1
   

2. Upgrade immediately. The post says there is no known workaround for the use cache issue and recommends upgrading even if your application has no similar functions.

3. Make sure the version of sharp that Next.js uses is 0.35.5 or later, particularly if you run on glibc-based Linux and rely on Image Optimization with SVG. The post says that upgrading Next.js to the patched versions makes package managers provide a fixed version, so verify the result rather than assume it.

4. Review your use cache functions and check whether any of them return multiple typed arrays. The post describes this condition as the trigger for the Critical issue, so the review helps you understand exposure. It does not replace the upgrade.

5. Identify applications that use the App Router with Server Actions and prioritize them for the denial-of-service fix. According to the post, Pages Router applications and applications without Server Actions are not vulnerable to that issue.

How readers can check whether they are affected #

Start by comparing each application's Next.js version with the patched line for its release. The advisory gives 16.4.1 for the 16.x line and 15.5.28 for the 15.x line. Any 16.x installation below 16.4.1, and any 15.x installation below 15.5.28, is below the patched version named in the post. The post does not describe how to read the installed version, so use the method your team already relies on for dependency inspection and confirm the result against the deployed build.

Next, check the sharp version that Next.js uses. The post names 0.35.5 as the threshold for the workaround that addresses the SVG Image Optimization issue. If your application relies on Image Optimization and the resolved sharp version is below 0.35.5, or you cannot determine it, treat that as a finding to investigate before you consider the application protected.

For the App Router denial-of-service issue, answer two questions for each application. Does it use the App Router? Does it contain at least one Server Action? The post says that Pages Router applications and applications without Server Actions are not vulnerable to this issue. Answering these questions requires reviewing the code of each service, because one application may mix routing approaches across different parts of its codebase.

For the use cache issue, identify the functions that use caching and examine what each one returns. The condition described in the post is specific: functions that return multiple typed arrays. A manual review can narrow the candidates, but it may not reveal every indirect path. The post's instruction to upgrade immediately still applies to every deployment, whatever the review finds.

Reading the severity ratings #

The post assigns two Critical ratings and one High rating. This article repeats those labels without rescoring them. Both Critical issues involve unauthenticated remote code execution, meaning the post describes them as reachable without credentials under the stated conditions. That is why the advisory frames the update as urgent. The High issue is a denial of service. It affects availability rather than code execution, but the post explains that it blocks other requests in the same process, so a service can become unresponsive.

Severity is most useful for setting the order of work. The advisory already sets the priority by asking readers to upgrade immediately. Teams that run several Next.js applications should treat the change as a task that covers all of them. A partial rollout leaves some services exposed while others are fixed, so it helps to record which applications run which release line and confirm that each one has been updated.

Dependencies and the update path #

Two of the three issues connect to upstream advisories, and the Image Optimization issue depends on an image library that Next.js uses. Frameworks are assembled from several packages, so a vulnerability can enter through a rendering library, an image processor, or another dependency. The fix can reach an application through the framework's dependency graph rather than through edits to the application's own code. That is why the post emphasizes upgrading the framework and confirming the resolved sharp version.

Teams that pin dependencies tightly should not assume that an upgrade changed everything they expect. After running the install commands, repeat the checks described above and confirm the Next.js and sharp versions that the project resolves.

Limits of this analysis #

This analysis rests on a single source: the Next.js Security Update for Upstream Vulnerabilities post, dated 2026-10-14. It does not include the full text of the linked upstream advisories, exact affected version ranges, or exploit details. Where the post is silent, this article makes no claim. The post does not identify the two postponed fixes, so this article does not link the delay to any issue. This article has not verified any patch by running code. Readers should confirm the fix in their own environments.

For questions about Vercel's security programs or vulnerability management, the post directs readers to security@vercel.com. It also mentions Vercel's Open Source Bug Bounty for researchers who want to contribute to the security of eligible frameworks.