Next.js releases out‑of‑band patch for two critical RCE flaws

On October 14, 2026, Next.js issued an out‑of‑band patch. The patch addresses two critical remote‑execution bugs. It also addresses a high‑severity denial‑of‑service issue. One of the critical vulnerabilities lies in React Server Components.

React Server Components is a feature that lets developers render React components on the server. The other critical vulnerability exists in the librsvg library that Next.js accesses through the sharp package. Librsvg is an SVG‑rendering library. Sharp is an image‑processing library used by Next.js for optimizing pictures.

Both code‑execution flaws received a CVSS score of 9.5. CVSS is a system that rates the severity of software vulnerabilities. Vercel rated the flaws as critical. Vercel is the company that maintains Next.js.

The fixes are included in Next.js version 16.4.1 for the Active LTS line. The fixes are also included in Next.js version 15.5.28 for the Maintenance LTS line. LTS stands for long‑term support, meaning the version receives updates for an extended period. The React Server Components flaw affects versions 19.0.0 through 19.3.0 of three specific packages.

Versions 19.0.0 through 19.3.0 of react‑server‑dom‑webpack, react‑server‑dom‑parcel and react‑server‑dom‑turbopack are affected by the React Server Components flaw. In a Next.js application, the flaw can be triggered when a use cache function returns more than one typed array. The use cache function is a hook that lets developers cache values during rendering. Only Next.js version 16 applications that have Cache Components enabled are exposed to this flaw.

Cache Components is a feature that allows components to cache on the server. Vercel recommends upgrading to the patched Next.js versions even if an application does not use the use cache function. The second critical flaw is a memory bug in librsvg, the SVG‑rendering library accessed via sharp. Code execution can occur when Next.js runs on glibc‑based Linux systems.

Glibc is the GNU C Library, a core component of many Linux distributions. By default Next.js does not optimize SVG files. Serving SVG files through the image optimizer requires enabling the dangerouslyAllowSVG setting. The dangerouslyAllowSVG setting tells Next.js to allow SVG files to be processed by the image optimizer.

The same librsvg library also renders images for the next/og feature when it runs on the Node.js runtime. Next/og is a Next.js module that generates open graph images for social sharing. Node.js is the JavaScript runtime used to execute Next.js applications on the server. A denial‑of‑service flaw affects App Router apps that define at least one Server Action.

App Router apps can define Server Actions. Server Actions are functions that run on the server in response to user interactions. Crafted requests can push the server process to full CPU use, stopping it from handling other requests. Apps that use the Pages Router, or that have no Server Actions, are not affected by this denial‑of‑service flaw.

Pages Router is the older routing system in Next.js. Upgrading to Next.js 16.4.1 bundles sharp version 0.35.5, which contains the patched librsvg version 2.63.2. Users of Next.js 15 must manually ensure that sharp is at least version 0.35.5 to get the patched librsvg. As of October 15, 2026, there are no public reports that attackers have used any of the three flaws fixed on October 14.