Next.js patches two critical RCE flaws

Feeds.4Sysops •IT News • October 15, 2026

.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote-code-execution flaws and a high-severity denial-of-service bug. Version 15 users should verify that `sharp` is updated too: the .js patch may leave an affected version installed. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Next.js Releases Security Update for RCE Vulnerabilities On October 14, 2026, Vercel released an out-of-band security update for Next.js, addressing two unauthenticated remote code execution (RCE) vulnerabilities and a high-severity denial-of-service flaw. The update, available in versions 16.4.1 and 15.5.28, fixes issues with React Server Components and the librsvg library used for SVG image rendering. The first RCE vulnerability, affecting versions 16.0.0 to 16.4.0, can be exploited when server responses include multiple typed arrays and an attacker-controlled value. The second flaw, tracked as CVE-2026-96889, is a memory bug in librsvg that allows code execution on glibc-based Linux systems. The denial-of-service flaw can cause high CPU usage in affected applications, leading to service disruption. Developers are urged to upgrade immediately, even if their applications do not utilize the vulnerable functions. 16 sources 72

Next.js patches two critical RCE flaws

The full story

Extracted Entities

Platforms (1)

Tools (1)