Next.js posted the update on its blog on Oct 14 after announcing it the week before. Two of the fixes had been held back from the September security release while upstream dependencies caught up. There are three advisories: two critical RCEs and one high-severity denial of service. As of Oct 15, neither RCE is in CISA's KEV catalog, and Vercel, React and sharp have not reported attacks.
Bug 1: use cache returning typed arrays (GHSA-673q-mjm6-r5xr). This one affects Next.js 16.0.0 through 16.4.0 in App Router apps with Cache Components turned on. An app is exploitable when a use cache function returns multiple typed arrays. The root cause is upstream in React (GHSA-xqc2-xf4c-x3h3). It covers react-server-dom-webpack, -parcel and -turbopack 19.0.0 through 19.3.0, fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1. React calls the trigger "extremely rare": the response has to carry multiple typed arrays plus a value the attacker controls. Vercel lists no workaround and tells teams to upgrade even if they don't think they have such a function. That's the right call. Nobody can grep a large codebase for this pattern and trust the answer.
Bug 2: SVG through sharp and librsvg (CVE-2026-96889, GHSA-2464-fhr4-w9xw). This one reaches much further back, to Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. It's a memory bug in librsvg, which sharp uses to decode SVGs for the Image Optimization API. Per the advisories, code execution is possible when Next.js runs on glibc-based Linux. In practice, the app has to optimize SVGs that an attacker can supply. Next.js doesn't optimize SVGs by default, so look for dangerouslyAllowSVG in your image config. The Hacker News adds that the same library renders images for next/og when it runs on the Node.js runtime. sharp's own advisory (GHSA-wq5f-xc86-pv6w) puts the fix in sharp 0.35.5, which ships librsvg 2.63.2. If you can't move Next.js today, pin sharp to 0.35.5 or later, or block SVG decoding in sharp with sharp.block({ operation: ["VipsForeignLoadSvg"] }).
Bug 3: Server Actions denial of service (GHSA-p3m5-59mp-jv5r). Rated high. It affects 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0 in App Router apps with at least one Server Action. Crafted requests pin the CPU and block other requests handled by the same process. Pages Router apps and apps without Server Actions aren't affected.
Why buyers should care. Next.js runs a lot of enterprise front ends, customer portals and internal tools. The last critical RSC bug, React2Shell (CVE-2025-55182), drew exploitation attempts from China-nexus groups within hours of its Dec. 3, 2025 disclosure, per Amazon's threat intelligence team. This pair needs specific conditions, and nothing says it's being exploited. Still, a public diff in a framework this widely deployed is exactly what exploit developers read first. Ask your AppSec and platform teams which apps run Next.js, which version, and where they're hosted. Self-hosted apps on glibc Linux images such as Debian or Ubuntu bases carry the SVG risk. Alpine and musl builds fall outside the advisory's stated condition.
What we'd do today. Run an SBOM or lockfile query for next, react-server-dom-* and sharp across every repo and image, including vendor-built marketing sites. Upgrade to 16.4.1 or 15.5.28 and redeploy. A bumped lockfile does nothing until the running container is rebuilt. Where an upgrade has to wait, pin sharp 0.35.5 and turn off dangerouslyAllowSVG. For hunting, alert on shells or interpreters spawned by the Next.js node process, unexpected outbound connections from front-end pods, and bursts of SVG requests to /_next/image.