Next.js Patches Two Critical RCEs, One With No Workaround

Next.js shipped an out-of-band security update Oct. 14 fixing two critical unauthenticated remote code execution bugs and one high-severity denial of service, according to the Next.js security update. One of the RCEs has no workaround. Patched versions are 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS).

What Was Fixed

• use cache RCE (critical, GHSA-673q-mjm6-r5xr): apps using App Router with Cache Components can be exploited without authentication when a use cache function returns multiple typed arrays. The Next.js team said there is no known workaround. It told all users to upgrade, even those without similar functions. Netlify said only 16.x apps with that pattern are affected.
• Image Optimization RCE (critical, CVE-2026-96889 / GHSA-2464-fhr4-w9xw): a memory-related flaw in an upstream library, sharp, can lead to code execution on glibc-based Linux when SVGs are processed. The workaround is sharp 0.35.5 or later. Upgrading Next.js pulls in a fixed version.
• Server Actions DoS (high, GHSA-p3m5-59mp-jv5r): crafted requests to App Router apps with at least one Server Action can burn CPU and block other requests in the same process. Pages Router apps and apps without Server Actions are not vulnerable. Netlify lists affected versions as 13.x through 16.x.

Two of the three fixes were postponed from the September release because of upstream dependency delays, the Next.js team said. It announced the Oct. 14 date a week earlier.

What Netlify said

Netlify published its own changelog entry the same day. It said next/image is not exposed on Netlify because Netlify Image CDN serves that API. Apps that render untrusted input through next/og ImageResponse are affected, but Netlify said the impact is a crashed function invocation, not code execution. It rated the Server Actions DoS minimal. Autoscaling keeps one CPU-hungry request from starving others. Active exploitation could still raise function costs.

Netlify also flagged what the Next.js post does not. Publicly reachable deploy previews and branch deploys can stay vulnerable until they are automatically deleted. It suggested deleting them by hand.

Firerun’s take

The use cache bug is the one to act on. Nothing short of upgrading fixes it. Netlify’s host-side scoping covers specific paths and is not a patch. Upgrade, redeploy, then clear old previews.

Key Takeaways

• Upgrade to next@16.4.1 or next@15.5.28.
• The use cache RCE has no workaround; the sharp RCE can be mitigated with sharp 0.35.5 or later.
• Old public deploy previews and branch deploys may still run vulnerable code.