{"id":3567,"date":"2026-10-15T18:39:11","date_gmt":"2026-10-15T18:39:11","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3567"},"modified":"2026-10-15T18:39:11","modified_gmt":"2026-10-15T18:39:11","slug":"next-js-ships-out-of-band-patch-for-two-critical-rce-flaws-in-caching-and-svg-processing","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3567","title":{"rendered":"Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing"},"content":{"rendered":"
\n
<\/a><\/div>\n

Next.js released an out-of-band security update<\/a> on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.<\/p>\n

One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.<\/p>\n

The fixes are in Next.js 16.4.1 and 15.5.28, the current Active and Maintenance long-term support (LTS) releases.<\/p>\n

What Was Fixed<\/h3>\n

The update covers three separate issues. Vercel, which develops Next.js, rated both code-execution flaws critical, each with a CVSS score of 9.5. The table lists the versions each issue affects and the version that fixes it.<\/p>\n\n\n\n\n\n\n
\n Issue\n <\/th>\n\n Affected versions\n <\/th>\n\n Fixed in\n <\/th>\n\n Who is exposed\n <\/th>\n<\/tr>\n

\n Code execution through use cache<\/code> (
\n
\n GHSA-673q-mjm6-r5xr
\n <\/a>
\n )
\n <\/span><\/th>\n		\n 16.0.0 through 16.4.0\n <\/td>\n\n 16.4.1\n <\/td>\n\n App Router apps with Cache Components enabled, where a use cache<\/code> function returns more than one typed array\n <\/td>\n<\/tr>\n

\n Code execution through SVG images (CVE-2026-96889,
\n
\n GHSA-2464-fhr4-w9xw
\n <\/a>
\n )
\n <\/span><\/th>\n		\n 10.0.0 through 15.5.27, and 16.0.0 through 16.4.0\n <\/td>\n\n 16.4.1, or 15.5.28 with sharp<\/code> 0.35.5 or later\n <\/td>\n\n Apps that pass attacker-supplied SVG files to sharp<\/code> on glibc-based Linux\n <\/td>\n<\/tr>\n

\n Denial of service through Server Actions (
\n
\n GHSA-p3m5-59mp-jv5r
\n <\/a>
\n )
\n <\/span><\/th>\n		\n 13.0.0 through 15.5.27, and 16.0.0 through 16.4.0\n <\/td>\n\n 15.5.28, 16.4.1\n <\/td>\n\n App Router apps with at least one Server Action\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Who Is Affected<\/h3>\n

The first code-execution flaw is in React Server Components, the React feature that runs user-interface components on the server. React’s advisory<\/a> covers three packages, react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, in versions 19.0.0 through 19.3.0. It describes the flaw as affecting \u00abextremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.\u00bb<\/p>\n

In a Next.js app, the trigger is a use cache<\/code> function that returns more than one typed array, so only version 16 apps that enable Cache Components, the feature behind use cache<\/code>, are exposed. Vercel says to upgrade even if your app has no such function.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The second flaw is a memory bug in librsvg, the library that renders SVG images, which Next.js reaches through the bundled sharp<\/code> package. Code execution is possible when Next.js runs on glibc-based Linux, according to the advisory.<\/p>\n

<\/p>\n

By default, Next.js does not optimize SVG files. Serving them through the image optimizer requires turning on a setting called dangerouslyAllowSVG<\/code><\/a>. The same library also renders images for next\/og<\/code>, the feature that builds social-preview images, when that feature runs on the Node.js runtime.<\/p>\n

The third flaw is a denial-of-service issue. In App Router apps that define at least one Server Action, crafted requests can push one server process to full CPU use and stop it from handling other requests. Apps on the Pages Router, or with no Server Actions, are not affected.<\/p>\n

Exposure can differ by host. Netlify said<\/a> its platform does not run the image-optimizer code path and that the flaws have limited impact on its setup, while still recommending the upgrade.<\/p>\n

What to Do<\/h3>\n

Upgrade to Next.js 16.4.1 if you run version 16, or 15.5.28 if you run version 15, then rebuild and redeploy.<\/p>\n

Vercel’s advisory says upgrading Next.js makes package managers supply the fixed sharp<\/code> automatically. On version 16 that holds, because 16.4.1 requires sharp<\/code> 0.35.5.<\/p>\n

On version 15 it may not. 15.5.28 still accepts the older, affected sharp<\/code> 0.34.x, and upgrading over an existing install can leave that version in place. Check with npm ls sharp<\/code> and update sharp<\/code> to 0.35.5 or later if it is older.<\/p>\n

If you cannot upgrade Next.js right away, the image flaw has an interim option: make sure sharp<\/code> is 0.35.5 or later, or block SVG rendering in sharp<\/code> with sharp.block({ operation: [\"VipsForeignLoadSvg\"] })<\/code>, as the sharp advisory<\/a> describes. The use cache<\/code> and Server Actions flaws have no workaround, and only the upgrade closes them.<\/p>\n

As of October 15, the use cache<\/code> and Server Actions advisories had no CVE and did not appear in the npm advisory feed that npm audit<\/code> uses, so dependency scanners may not warn you about them. The image flaw does surface, through sharp<\/code>‘s own advisory.<\/p>\n

Why the Image Flaw Keeps Returning<\/h3>\n

This is the third time since August that image processing in Next.js has produced a code-execution flaw. In August, a bug in libheif, reached through sharp<\/code>, allowed code execution when the optimizer handled a crafted AVIF image. In September, a flaw in next\/og<\/code> let attacker-controlled text change the SVG it generated.<\/p>\n

Next.js did not change its own image code this time. 16.4.1 ships the same optimizer as 16.4.0 and fixes the image flaw by raising the bundled sharp<\/code> to 0.35.5, which carries a patched librsvg (2.63.2).<\/p>\n

The librsvg bug, CVE-2026-96889<\/a>, was made public on September 23 and fixed in sharp<\/code> on September 27. Red Hat scored it 7.8 and said exploiting it needs user interaction, such as opening a malicious file. Vercel rated the Next.js exposure 9.5 and reachable over the network.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The researcher who reported the librsvg bug, Rafael B. Dias, says it is the weakness behind September’s next\/og<\/code> flaw. A working exploit for that earlier flaw, built for one specific server setup, has since been published.<\/p>\n

sharp’s maintainer also warns that whether the flaw ends in code execution or only a crash can come down to the server’s Node.js build, because the official Node.js binaries are not hardened against this kind of memory attack.<\/p>\n

Not the Same as React2Shell<\/h3>\n

The React Server Components flaw sits in the same three packages as React2Shell, the maximum-severity flaw disclosed in December 2025 that attackers exploited at scale. This one is far narrower. React describes it as affecting \u00abextremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.\u00bb<\/p>\n

As of October 15, there are no public reports that any of the three flaws fixed on October 14 has been used in attacks.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in…<\/p>\n","protected":false},"author":1,"featured_media":3568,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3809,58,11,151,3808,348,3810,316,3807,2595],"class_list":["post-3567","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-caching","tag-critical","tag-flaws","tag-next-js","tag-outofband","tag-patch","tag-processing","tag-rce","tag-ships","tag-svg"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3567"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3567\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3568"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}