nextjs

Next.js ships two unauthenticated RCEs in one release

Vercel's 2026-10-14 security releases (v16.4.1 and v15.5.28) fix three vulnerabilities: two critical unauthenticated remote code execution bugs and one high-severity denial of service. One of the RCEs has no workaround.

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share
Next.js ships two unauthenticated RCEs in one release
A web server rack with one fault LED lit, beside a monitor showing a web page, rendered with AI.

Vercel shipped two security releases on 2026-10-14, v16.4.1 and v15.5.28, that together fix three vulnerabilities. Two are critical unauthenticated remote code execution bugs. The third is a high-severity denial of service. The GitHub Security Advisories went public on 2026-10-22.

The two RCEs

The first is in the App Router Cache Component. A use cache function that returns multiple typed arrays leads to remote code execution. There is no known workaround, and the advisory tells operators to upgrade even if their application does not use such functions. Affected: next 16.0.0 through 16.4.0, fixed in 16.4.1.

The second is in Image Optimization. A memory-related flaw in the bundled sharp dependency (which carries libopenjp2) leads to RCE when Next.js runs on glibc-based Linux and SVG files are used. The workaround is to ensure sharp is at least 0.35.5; fresh installs already pull a fixed version, and upgrading Next.js to the patched releases does the same. Affected: next 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0, fixed in 15.5.28 and 16.4.1.

The DoS

A crafted request against an App Router application that uses at least one Server Action causes excessive CPU consumption and blocks processing of further requests in the same process. NVD scores it 8.2 (HIGH, CVSS v4.0). Affected: next 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0, fixed in 15.5.28 and 16.4.1.

What to check

If you run Next.js, the version check is the whole story. On the 16.x line, anything at or below 16.4.0 is exposed to the cache RCE, and the 15.x line at or below 15.5.27 is exposed to the SVG RCE and the DoS. The no-workaround RCE is the one that makes this urgent: there is no configuration change that closes it, so the fix is the upgrade.

None of the three has confirmed in-the-wild exploitation as of this writing, and the two RCE advisories carry no CVE or CVSS yet. That is not a reason to wait. The exposure is real and the fix is a version bump.

Two RCE classes in one release

The two RCEs are structurally different, and that is the part worth sitting with. The first is a logic flaw in Next.js's own cache transport, with no workaround. The second is a memory-safety flaw inherited from a bundled native dependency, and it only shows up on glibc-based Linux with SVG input. One release ships a framework-logic RCE and a supply-chain RCE side by side.

The cache layer is not new territory for this project. An earlier cache-poisoning advisory (CVE-2026-94484) was fixed in 15.5.27 and 16.3.8 in early October. The cache machinery keeps being the attack surface, and this time the no-workaround path is the more severe one.

For a self-hosted SaaS or an internal web app on the App Router, the operational move is the same as any other security release: check the version, upgrade to 16.4.1 or 15.5.28, and if you are stuck on the 15.x line, bump sharp to 0.35.5. The SVG RCE is the one that quietly survives a host-OS patch, because it lives in the dependency, not the kernel.

Sources

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.

Topics:

Read more