Cyberkendra Next.js Releases Security Update for RCE Vulnerabilities
Article Content
- •Next.js patched two critical RCE vulnerabilities and a high-severity DoS flaw.
- •CVE-2026-96889 is a memory bug in librsvg affecting glibc-based Linux systems.
- •Immediate upgrade to Next.js versions 16.4.1 or 15.5.28 is recommended.
On October 14, 2026, Vercel released an out-of-band security update for Next.js, addressing two unauthenticated remote code execution (RCE) vulnerabilities and a high-severity denial-of-service flaw. The update, available in versions 16.4.1 and 15.5.28, fixes issues with React Server Components and the librsvg library used for SVG image rendering. The first RCE vulnerability, affecting versions 16.0.0 to 16.4.0, can be exploited when server responses include multiple typed arrays and an attacker-controlled value. The second flaw, tracked as CVE-2026-96889, is a memory bug in librsvg that allows code execution on glibc-based Linux systems. The denial-of-service flaw can cause high CPU usage in affected applications, leading to service disruption. Developers are urged to upgrade immediately, even if their applications do not utilize the vulnerable functions.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Red Hat and CVE-2026-96889 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of Next.js are affected?
What is CVE-2026-96889?
What should I do if I can't upgrade immediately?
Continue Reading
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include… 
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…