SOLUTIONSQuick answer
On 14 October 2026 Next.js released 16.4.1 and 15.5.28 to fix two critical remote code execution flaws, one in `use cache` functions and one in SVG image optimisation through sharp, plus a high-severity denial of service in App Router apps with Server Actions. Every Next.js 13–16 site should upgrade to 16.4.1 or 15.5.28 or later.
Key takeaways
- Two critical (CVSS 4.0 9.5) remote code execution bugs and one high-severity DoS were fixed on 14 October 2026.
- Safe versions: Next.js 16.4.1 or later on the 16 line, 15.5.28 on the 15 line.
- Next.js says to upgrade even if your app does not use the affected features.
- Self-hosted apps on glibc Linux using image optimisation are the main SVG risk; sharp 0.35.5 is the interim workaround.
- The release also includes the September fixes from 16.3.8, so older 16.x sites get both sets in one upgrade.
What did the October 2026 Next.js security update fix?
| Advisory | Severity | What it affects | Workaround |
|---|---|---|---|
| GHSA-673q-mjm6-r5xr | Critical | Unauthenticated RCE when a use cache function returns multiple typed arrays (App Router with Cache Components) | None: upgrade |
| CVE-2026-96889 / GHSA-2464-fhr4-w9xw | Critical | Unauthenticated RCE in the Image Optimization API with SVG, via an upstream library in sharp, on glibc-based Linux | Use sharp 0.35.5 or later |
| GHSA-p3m5-59mp-jv5r | High | Crafted requests cause excessive CPU and block the process in App Router apps with at least one Server Action | None: upgrade |
The two critical issues were postponed from the September security release because they depended on fixes in upstream packages (React and sharp). Next.js bundles its own copy of the React Server Components packages, so upgrading next is what fixes a Next.js app.
Is my Next.js site affected?
- Next.js 16.0.0 to 16.4.0: affected by all three advisories, depending on the features you use.
- Next.js 13.x to 15.5.27: affected by the Server Actions DoS and, from 10.0.0, by the SVG image optimisation issue.
- Pages Router apps, or App Router apps without Server Actions: not affected by the DoS.
- Sites hosted on Vercel or Netlify: platforms added protections, but Netlify, for example, still recommends upgrading and redeploying; old preview deployments may remain vulnerable until deleted.
How do I upgrade Next.js safely?
# Next.js 16
npm install next@16.4.1 eslint-config-next@16.4.1
# Next.js 15
npm install next@15.5.28 eslint-config-next@15.5.28
# confirm the installed version and the bundled sharp
npm ls next sharp- Upgrade
next(a newer 16.4.x patch release is also fine) and the matchingeslint-config-next. - Run your type check, linter, tests and a production build (
next build). - Check the pages that use images, forms, caching and any Server Actions in a staging or preview deployment.
- Deploy, then confirm the running version, not just the one in
package.json. - Delete old preview deployments that still run a vulnerable build.
We applied this update to naarvixsolutions.com itself: moving from 16.3.5 to the current 16.4.x patch release was a drop-in upgrade with no code changes, verified by our test suite and a full production build before deploying.
What about the September 2026 Next.js security release?
Next.js also ran a scheduled security release on 30 September 2026, fixing seven vulnerabilities (one high, five medium, one low) in 16.3.8 and 15.5.27. Note that 16.3.7, published the day before, contained a bug fix but not those security fixes. Upgrading to 16.4.1 or later covers both the September and October fixes.
How should teams handle framework security releases?
- Watch the source: follow the Next.js blog and GitHub security advisories; Next.js now announces scheduled releases about a week ahead.
- Keep upgrades small: a site that is one minor version behind upgrades in minutes; one that is two majors behind can take weeks.
- Automate checks: run
npm auditin CI and use Dependabot or Renovate so security bumps arrive as reviewable pull requests. - Own the runtime too: October also brought critical PHP2Shell flaws; every stack needs someone responsible for patching it.
Naarvix builds and maintains Next.js sites and apps. If you need an upgrade done safely, or a maintenance routine so this is never urgent again, see our web development service or contact us.
Sources
Frequently asked questions
Which Next.js version fixes the October 2026 vulnerabilities?
Next.js 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS). Later 16.4.x patch releases include the fixes too.
Is there a workaround if I cannot upgrade Next.js yet?
Only for the SVG image optimisation flaw: make sure Next.js uses sharp 0.35.5 or later. The use cache RCE and the Server Actions DoS have no workaround, so plan the upgrade as soon as possible.
Does the vulnerability affect the Pages Router?
The Server Actions DoS only affects App Router apps with at least one Server Action. The SVG image optimisation issue depends on the Image Optimization API rather than the router, so Pages Router sites using next/image should still upgrade.