Next.js 16.4.1 and 15.5.28: two critical RCEs in use cache and SVG image optimization, plus a Server Actions DoS

The Next.js team tagged v16.4.1 and v15.5.28 on October 14, 2026, outside the regular schedule. Maintainer eps1lon published three advisories the same day. Two are critical and allow unauthenticated remote code execution. The third lets a crafted request tie up a server process. The September 22 post on this site covered the next/og advisory; this round touches different code.

The three advisories

Next.js security advisories, October 14, 2026
Advisory	Bug	CVSS v4	Affected	Fixed in
GHSA-673q-mjm6-r5xr	RCE in `use cache` functions returning typed arrays	9.5	16.0.0 to 16.4.0	16.4.1
GHSA-2464-fhr4-w9xw (CVE-2026-96889)	RCE in Image Optimization API with SVG files	9.5	10.0.0 to 15.5.27, 16.0.0 to 16.4.0	15.5.28, 16.4.1
GHSA-p3m5-59mp-jv5r	DoS in App Router with Server Actions	8.2	13.0.0 to 15.5.27, 16.0.0 to 16.4.0	15.5.28, 16.4.1

All three vectors share the same shape: network access, no privileges, no user interaction. The CVSS scores mark "attack requirements present," so each bug needs a specific setup in your app before an attacker can use it.

use cache and typed arrays

The first advisory affects App Router projects with Cache Components turned on. A use cache function that returns more than one typed array opens a path to remote code execution. The advisory doesn't describe the mechanism, and it lists no workaround.

// The pattern GHSA-673q-mjm6-r5xr describes
async function getSamples(id: string) {
  "use cache";
  const res = await fetch(`https://api.example.com/samples/${id}`);
  const buf = await res.arrayBuffer();
  return {
    left: new Float32Array(buf, 0, 1024),
    right: new Float32Array(buf, 4096, 1024),
  };
}

Your codebase might have none of these. The advisory tells you to upgrade anyway, and you should. Grepping for "use cache" near Uint8Array, Float32Array or Buffer tells you how exposed you were, which matters if you need to look back through logs. It doesn't tell you you're safe on 16.4.0.

The affected range for this one starts at 16.0.0, so 15.x apps don't need to look for it.

SVG through the image optimizer

The second critical bug lives upstream of Next.js. A memory flaw in sharp, the library behind next/image optimization, can lead to remote code execution when Next.js runs on glibc-based Linux. Debian and Ubuntu base images use glibc. The affected range starts at 10.0.0, so old apps you forgot about count too.

This advisory has a workaround. Make sure your install resolves sharp 0.35.5 or later:

npm ls sharp
# every entry should show 0.35.5 or newer

A fresh install of a patched Next.js pulls a fixed sharp for you. A lockfile from last month won't. If you can't move Next.js today, add an overrides entry for sharp in package.json (or resolutions in Yarn), reinstall, and run npm ls sharp again.

Server Actions and CPU

The third advisory scores lower but reaches further. Any App Router app with at least one Server Action is affected, back to 13.0.0. A crafted request causes "excessive CPU usage blocking processing of further requests" in the same process. An attacker can stall a Node process and the requests queued behind it.

The advisory says no workaround exists besides upgrading. Pages Router apps and App Router apps without Server Actions are safe from this one.

Upgrade

# 16.x
npm install [email protected]

# 15.x
npm install [email protected]

Versions 14 and older get no patch. If you run Next.js 13 or 14 with Server Actions, or any version from 10 up with next/image on Linux, you need a major upgrade. Until then, the sharp override closes the image bug, and nothing closes the Server Actions one except removing them.

This week

Upgrade to 16.4.1 or 15.5.28 and deploy before the weekend. Both are patch releases with no other changes listed.
Run npm ls sharp in each deployed app and confirm 0.35.5 or newer. Check Docker images too, since a cached layer can keep the old version.
If you allow SVG through images.dangerouslyAllowSVG or remote patterns, review which hosts can feed your optimizer.
Search your logs since your last deploy for unusual traffic to /_next/image and to Server Action endpoints.

If you maintain an app on 13 or 14 that your team hasn't touched in a year, put the major upgrade on next sprint's board. The Server Actions fix stops at 15.5, so 13 and 14 stay exposed.

Volodymyr Chornous