Full Report
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in
Analysis Summary
# Vulnerability: Next.js Critical RCE and DoS Flaws (October 2026)
## CVE Details
- **CVE ID:** CVE-2026-96889 (SVG RCE); GHSA-673q-mjm6-r5xr (Cache RCE); GHSA-p3m5-59mp-jv5r (DoS)
- **CVSS Score:** 9.5 (Critical) for both RCE flaws; High severity for DoS.
- **CWE:** Memory corruption (librsvg), Improper input validation (Server Actions/Cache).
## Affected Systems
- **Products:** Next.js Framework, React (specific server-dom packages), and `sharp` image processing library.
- **Versions:**
- **SVG RCE:** Next.js 10.0.0 – 15.5.27, and 16.0.0 – 16.4.0.
- **Cache RCE:** Next.js 16.0.0 – 16.4.0; React 19.0.0 – 19.3.0.
- **DoS:** Next.js 13.0.0 – 15.5.27, and 16.0.0 – 16.4.0.
- **Configurations:**
- **SVG RCE:** Apps using `dangerouslyAllowSVG` or `next/og` on glibc-based Linux.
- **Cache RCE:** App Router apps with Cache Components enabled where `use cache` returns multiple typed arrays.
- **DoS:** App Router apps with at least one Server Action defined.
## Vulnerability Description
1. **SVG RCE:** A memory bug in `librsvg` (accessed via the `sharp` package) allows for remote code execution when processing malicious SVG files on glibc-based Linux systems.
2. **Cache RCE:** A flaw in React Server Components occurs in rare cases where responses transport multiple typed arrays and an attacker-controlled value, leading to code execution.
3. **Denial of Service:** Crafted requests to Server Actions can cause a server process to reach 100% CPU utilization, hanging the process and preventing it from handling further traffic.
## Exploitation
- **Status:** PoC availability not explicitly confirmed in text; likely in development given the out-of-band nature.
- **Complexity:** Low to Medium (depending on the specific flaw).
- **Attack Vector:** Network (Unauthenticated).
## Impact
- **Confidentiality:** High (Full system compromise via RCE).
- **Integrity:** High (Full system compromise via RCE).
- **Availability:** High (Service disruption via DoS or RCE).
## Remediation
### Patches
- **Next.js 16.x:** Upgrade to **v16.4.1**.
- **Next.js 15.x:** Upgrade to **v15.5.28**.
- **Dependency Note:** Ensure `sharp` is updated to **v0.35.5** or later. In version 15.x, this may require a manual update (`npm install sharp@latest`).
### Workarounds
- **SVG Flaw:** Block SVG rendering in `sharp` using: `sharp.block({ operation: ["VipsForeignLoadSvg"] })`.
- **Cache/DoS Flaws:** No known workarounds; administrative upgrade is required.
## Detection
- **Indicators of Compromise:** High CPU usage on Node.js processes (DoS); unusual outbound network traffic from web servers (RCE).
- **Detection methods:** Run `npm ls sharp` to check for vulnerable versions (< 0.35.5). Monitor for requests targeting Server Action endpoints with unusual payloads.
## References
- **Vendor Advisory:** hxxps://nextjs[.]org/blog/nextjs-security-update-october-14-2026
- **GitHub Advisory (SVG):** hxxps://github[.]com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw
- **GitHub Advisory (Cache):** hxxps://github[.]com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
- **React Advisory:** hxxps://github[.]com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3