Description
Next.js has released an out-of-band security update fixing three vulnerabilities disclosed on October 14, 2026: two unauthenticated RCE flaws and one DoS flaw. GHSA-673q-mjm6-r5xr occurs when an App Router application using Cache Components has a use cache function that returns multiple typed arrays, allowing attackers to execute code remotely. CVE-2026-96889 stems from a memory error in an upstream image-processing library (librsvg, used by Next.js through sharp) when the Image Optimization API processes SVG files on glibc-based Linux, and can lead to RCE. GHSA-p3m5-59mp-jv5r allows specially crafted requests to App Router Server Actions to cause excessive CPU usage, leaving the process unable to handle further requests.
- CVSS Score: 9.5 (CVSS v4.0, highest of the three)
- Severity: Critical
- GHSA-673q-mjm6-r5xr (RCE, use cache): 9.5 - Critical
- CVE-2026-96889 / GHSA-2464-fhr4-w9xw (RCE, Image Optimization with SVG): 9.5 - Critical
- GHSA-p3m5-59mp-jv5r (DoS, Server Actions): 8.2 - High
Affected Scope
These vulnerabilities affect Next.js (the npm package next). System administrators and development teams must review the versions and features in use and upgrade immediately. Affected scope per vulnerability:
- GHSA-673q-mjm6-r5xr (RCE - use cache): Next.js 16.0.0 to 16.4.0, App Router applications using Cache Components with a use cache function that returns multiple typed arrays. Upgrade to 16.4.1.
- CVE-2026-96889 (RCE - SVG processing): Next.js 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0, running on glibc-based Linux. Upgrade to 15.5.28 or 16.4.1 (with sharp 0.35.5 or later).
- GHSA-p3m5-59mp-jv5r (DoS - Server Actions): Next.js 13.0.0 to 15.5.27 and 16.0.0 to 16.4.0, App Router applications that use Server Actions. Upgrade to 15.5.28 or 16.4.1.
Note: GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r do not currently have CVE IDs, so some scanners (for example, npm audit) may not detect them.
Impact
- Arbitrary remote code execution on the server running Next.js without authentication or user interaction (GHSA-673q-mjm6-r5xr, CVE-2026-96889)
- Access to environment variables, secrets, credentials and application data, and lateral movement to related infrastructure from a compromised server
- Denial of service: excessive CPU consumption leaves the process unable to handle further requests (GHSA-p3m5-59mp-jv5r)
Remediation
- Upgrade Next.js to 16.4.1 (16.x branch) or 15.5.28 (15.x branch) immediately. There is no workaround for GHSA-673q-mjm6-r5xr; per the advisory, upgrade even if the application has no similar use cache functions.
- Ensure the sharp library used by Next.js is version 0.35.5 or later to remediate CVE-2026-96889. Need to check the old lockfile may still keep sharp 0.34.x. Note that updating sharp alone does not fix the remaining two vulnerabilities
- Review the inventory of Next.js applications (version, Cache Components, Server Actions, sharp); rebuild and redeploy containers/images after upgrading, so the patch is actually shipped; monitor /_next/image endpoint logs for unusual SVG requests.
References
https://adsecvn.com/bai-viet/canh-bao-lo-hong-rce-nghiem-trong-trong-next-js-cap-nhat-ngay-ban-va
https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw
https://nvd.nist.gov/vuln/detail/cve-2026-96889
https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html
