Next.js 16.4.1 and 15.5.28 fix two critical remote code execution flaws

On October 14, 2026, Next.js released versions 16.4.1 and 15.5.28 to fix three vulnerabilities in its upstream dependencies. Two are rated critical because an attacker without an account can run code on the server. The third, rated high, lets crafted requests tie up the server process. The team announced the update on October 8, 2026, and said two of the three fixes had been postponed from the September release. Upgrading is the only complete fix: npm install next@16.4.1 on the 16 line and npm install next@15.5.28 on the 15 line.

Two critical flaws allow code execution

The first, GHSA-673q-mjm6-r5xr, affects apps that use the App Router with Cache Components. Cache Components let a developer mark a function with 'use cache' so its result is stored and reused. When such a function returns multiple typed arrays, an unauthenticated attacker can execute code on the server. The flaw is linked to a React advisory, GHSA-xqc2-xf4c-x3h3. There is no workaround, and Next.js tells developers to upgrade even if their app has no function of that kind.

The second, CVE-2026-96889, sits in a library that Image Optimization uses to process images. It is a memory flaw that SVG input can trigger, and it leads to remote code execution when Next.js runs on Linux built on glibc, the standard C library of most Linux distributions. Here a workaround exists: making sure the app uses sharp 0.35.5 or later. Upgrading Next.js pulls in the fixed sharp automatically.

A high-severity flaw can stall the server

GHSA-p3m5-59mp-jv5r affects apps that use the App Router and have at least one Server Action, a function that runs on the server when a form or button calls it. Crafted requests push CPU usage so high that the same process stops handling other requests, which is a denial of service. The flaw is linked to React advisory GHSA-h3gv-c5rc-p453. Apps that use the Pages Router, or that have no Server Actions, are not vulnerable.

Which version to install

The fixes ship only in 16.4.1 and 15.5.28. The post does not say whether apps hosted on Vercel are protected at the platform level.

• On the 16 line, install 16.4.1. There is no patch release for 16.3, so apps on 16.3 need to move to 16.4.
• On the 15 line, install 15.5.28.
• If an immediate upgrade is not possible, pinning sharp at 0.35.5 or later closes only the Image Optimization flaw.