VERCEL released out-of-band security updates for Next[.]js on 14 October 2026, delivering versions 16.4.1 and 15.5.28 to address two critical unauthenticated remote code execution flaws and a high-severity denial-of-service issue. The fixes cover vulnerabilities in App Router with Cache Components and in image handling, with one CVE and a separately tracked RCE issue tied to the React upstream.
The article notes that at-risk releases include Next[.]js 16.0.0 through 16.4.0 for the use cache RCE, and Next[.]js 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0 for the Server Actions DoS. Upgrading to 16.4.1 or 15.5.28 is advised, with a fallback mitigation of ensuring sharp is at least 0.35.5 if an upgrade is not yet possible.
The primary RCE via the “use cache” function occurs when a function returns multiple typed arrays, with the root cause linked to a React upstream advisory. The second RCE arises from an image-optimisation flaw in SVG handling, associated with CVE-2026-96889 and a memory bug in the sharp library affecting systems running glibc-based Linux. A separate Server Actions denial-of-service flaw could drive elevated CPU usage, potentially blocking subsequent requests in the same process.
Vercel reports no confirmed exploitation in the wild and no public PoCs confirmed at the time of the advisory. The publication urges immediate upgrading and notes that no workaround exists for the use cache flaw.