Next.js Security Advisories, October 2026: Two Critical RCEs and a DoS
By Arash Latifi
Three security fixes landed in Next.js 16.4.1 and 15.5.28 this week: an Image Optimization RCE, a `use cache` RCE, and a Server Actions DoS — plus an upgrade checklist.
TL;DR — On October 14–15, 2026, Next.js patched three serious issues in 16.4.1 and 15.5.28; two are unauthenticated RCEs scoring 9.5 — upgrade now, not next sprint.
What happened
Last week the Next.js team published three security advisories at once and shipped patched releases: 16.4.1 and 16.4.2 on the 16.x line, 15.5.28 on the 15 LTS line. Three of them matter a lot:
| Advisory | Issue | Severity | Affected | Patched |
| --- | --- | --- | --- | --- |
| GHSA-2464-fhr4-w9xw | RCE via Image Optimization API | Critical 9.5 | 10.0.0–15.5.27, 16.0.0–16.4.0 | 15.5.28 / 16.4.1 |
| GHSA-673q-mjm6-r5xr | RCE in use cache functions | Critical 9.5 | 16.0.0–16.4.0 | 16.4.1 |
| GHSA-p3m5-59mp-jv5r | DoS in App Router Server Actions | High 8.2 | 13.0.0–15.5.27, 16.0.0–16.4.0 | 15.5.28 / 16.4.1 |
Each one, in plain terms
1. RCE via Image Optimization (when SVG files are used). A memory-related vulnerability in the upstream library (sharp) that Next.js uses for image optimization; when Next.js runs on glibc-based Linux, it can lead to remote code execution. If you can't upgrade immediately, the workaround is ensuring the sharp version used by Next.js is at least 0.35.5 — fresh installs already get a fixed version.
2. RCE in use cache. Applies to App Router apps with Cache Components: a use cache function that returns multiple typed arrays enables RCE. There is no known workaround, and the official advice is to upgrade immediately even if your app has no such function.
3. DoS via Server Actions. Crafted requests against any App Router app with at least one Server Action cause excessive CPU usage, blocking further requests in the same process. Pages Router apps (or apps without Server Actions) are not affected. No workaround exists besides upgrading.
Why this round deserves priority
After the "React2Shell" episode (the critical React/Next.js RCE from December 2025), the pattern repeats: these bugs are exploitable over the network, without authentication, and most real projects use exactly the affected components — next/image, Server Actions, or use cache. Both lines get patches, so "I'm on an old version with no fix" is no longer an excuse.
Upgrade checklist — today
- [ ] Check your version:
next --versionorpackage.json. - [ ] On 16.x: upgrade to
16.4.2(latest patch, also carries Turbopack fixes). On 15.x: upgrade to15.5.28. - [ ] If you can't upgrade right now, at least pin
sharp >= 0.35.5(covers only issue 1). - [ ] Test in staging, then deploy — these are security patches, usually without breaking changes.
- [ ] Confirm the running version in production after deploy (startup log or health endpoint).
- [ ] Using Cache Components? Double your urgency — the
use cacheissue has no workaround. - [ ] Grep logs for suspicious Server Actions traffic — unexplained CPU spikes with no real traffic are the tell.
Self-hosted? You're the patch crew
If you deploy to your own servers or containers (rather than Vercel), the glibc-Linux precondition of the Image Optimization RCE is precisely your environment — and no platform applies the fix for you. Don't forget to restart the process after npm install; the old, vulnerable build keeps running until you do.
Q: How do I know if my production version is affected?
Trust next --version on the actual server or the version in your lock file. Ranges: the sharp issue affects 10.0.0–15.5.27 and 16.0.0–16.4.0; the use cache issue only 16.0.0–16.4.0; the DoS issue 13.0.0–15.5.27 and 16.0.0–16.4.0.
Q: Can a security patch release break anything?
Unlikely — these are patch releases with security fixes and a few backports (16.4.2 also carries Turbopack fixes). Still, run staging first, and if you use Turbopack in dev, restart dev once after upgrading.
Q: My app uses Pages Router — am I safe?
For the DoS issue, yes: Pages Router or no Server Actions means not vulnerable. But the Image Optimization issue is router-independent (it affects versions back to 10), so upgrade anyway. Being immune to one advisory is not a reason to skip the bulletin.