Next.js Critical RCE: Patch “use cache” and SVG Image Bugs Now

On October 14, 2026 Next.js shipped fixes for two unauthenticated remote code execution bugs (CVSS 9.5): one in “use cache” functions that return typed arrays, one in the Image Optimization API when SVG files go through sharp. Who is affected, the exact upgrade commands, how to check sharp, and two traps that leave apps exposed.”

Short answer: upgrade to Next.js 16.4.1 (or 15.5.28 on the 15.x line), make sure npm ls sharp shows 0.35.5 or newer, redeploy, and delete old preview deployments. Both bugs let an unauthenticated attacker run code on your server, and both are rated CVSS 9.5.

**Watch the video:**
https://youtube.com/shorts/Wwa3eil3Fwk?feature=share

I build my own client projects on Next.js, so this is the first thing I patched this week. Here is what changed and what to do.

What happened

On October 14, 2026, the Next.js team released an out-of-band security update. Two of its fixes had been held back from the September release while upstream dependencies were fixed. The patched versions are 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS).

Bug 1: Remote code execution in `use cache` functions that return typed arrays

ID: GHSA-673q-mjm6-r5xr (Next.js), upstream React GHSA-xqc2-xf4c-x3h3. There is no CVE.
Severity: Critical, CVSS v4 9.5. No login and no user interaction needed.
Affected: Next.js 16.0.0 to 16.4.0 apps that use the App Router with Cache Components, where a use cache function returns multiple typed arrays (Uint8Array, Float64Array and so on).
Workaround: none. The Next.js team says to upgrade even if your app has no function like that.

Something like this is the risky pattern:

// app/lib/stats.ts
export async function getStats() {
  'use cache'
  const views = new Uint32Array(7)
  const load = new Float64Array(7)
  return { views, load }
}

If you use React Server Components outside Next.js, the upstream fix is in react-server-dom-webpack, -turbopack and -parcel 19.0.9, 19.1.10, 19.2.9 and 19.3.1.

Bug 2: Remote code execution in Image Optimization when SVG files are used

ID: CVE-2026-96889 / GHSA-2464-fhr4-w9xw.
Severity: Critical, CVSS v4 9.5.
Affected: Next.js 10.0.0 to 15.5.27 and 16.0.0 to 16.4.0, when Next.js runs on glibc-based Linux (Ubuntu, Debian and most standard Node images).
Cause: a memory bug in the upstream image library Next.js uses for optimization (sharp).
Workaround: make sure the sharp used by Next.js is 0.35.5 or later.

Netlify notes that on its platform the next/image path is served by its Image CDN, while the next/og (ImageResponse) path is affected but limited to a crashed function. Self-hosted apps (VPS, Docker, PM2) are the ones to patch first.

The same release also fixes a high-severity denial of service in App Router apps that use at least one Server Action (GHSA-p3m5-59mp-jv5r). Pages Router apps and apps without Server Actions are not affected by that one.

How to patch

1. Upgrade Next.js

npm install next@16.4.1   # 16.x
npm install next@15.5.28  # 15.x

With pnpm or yarn: pnpm add next@16.4.1 or yarn add next@16.4.1. On 14.x or older there is no patched release line, so plan the jump to 15.5.28 or 16.4.1.

2. Check the sharp version

npm ls next sharp

You want sharp@0.35.5 or newer under next. The official note says upgrading Next.js makes package managers pull a fixed sharp, but some lockfiles can keep an older one. If yours does, pin it in package.json:

{
  "overrides": {
    "sharp": "^0.35.5"
  }
}

(pnpm: "pnpm": { "overrides": { "sharp": "^0.35.5" } }, yarn: "resolutions".) Then run npm install again and re-check.

In Docker, rebuild the image without cache so the new sharp binary is installed:

docker build --no-cache -t abd-store .

3. Redeploy and restart

A new package.json does nothing until the running server uses it. Redeploy on Vercel or Netlify; on your own server, rebuild and restart (npm run build && pm2 restart abd-store).

4. Delete old preview deployments

Old preview and branch deployments still run the vulnerable build. Netlify says they can stay vulnerable until they are deleted automatically, so delete the ones you don’t need now.

Two traps

npm audit may stay quiet. The use cache bug has no CVE, so tools that only read CVE-based feeds (npm audit, some Dependabot setups) may not flag it. Check your next version yourself.
“I don’t use use cache, so I’m fine.” The image bug goes back to Next.js 10, and the Next.js team asks everyone to upgrade anyway.

Checklist

next is 16.4.1 or 15.5.28 (or newer)
npm ls sharp shows 0.35.5 or newer
Production redeployed or server restarted
Old preview and branch deployments deleted
React Server Components outside Next.js: react-server-dom-* updated

Is anyone exploiting it?

As of October 25, 2026 I found no public reports of attacks. Singapore’s CSA alert (updated October 23) tells everyone to patch immediately. If that changes, I’ll update this post.

FAQ

Is Next.js 14 affected?
The image bug covers Next.js 10 through 15.5.27, so yes, and there is no 14.x patch. Upgrade to 15.5.28 or 16.4.1.

I’m on Vercel. Do I still need to do anything?
Yes. The fix is in your app’s dependencies, so you have to upgrade next and redeploy.

I use Alpine (musl) images. Am I safe from the SVG bug?
The advisory names glibc-based Linux. Don’t count on that: upgrade anyway, because the use cache bug doesn’t depend on the OS.

Can a WAF block these?
Not reliably. The payloads look like normal requests. Upgrading is the fix.

Watch the video:
https://youtube.com/shorts/Wwa3eil3Fwk?feature=share