Field note 44/ Engineering
Next.js October 14 Security Update: Patch to 16.4.1 or 15.5.28 Now
On October 14, 2026, Next.js shipped 16.4.1 and 15.5.28 to fix two Critical remote code execution bugs and one High severity denial of service. Here's what each advisory covers, who's exposed, and a quick way to check a project.
Next.js shipped an out-of-band security update on October 14, 2026. If you run Next.js 15 or 16, upgrade to 16.4.1 or 15.5.28 today. Two of the three fixes are rated Critical, and both are unauthenticated remote code execution bugs.
Vercel announced the release a week ahead, on October 8, and said two of the fixes were held back from the September security release while upstream dependencies caught up. Here's what each advisory covers, who's exposed, and a quick way to check a project.
The fix
These are the two patched versions Vercel lists. 16.4 is the Active LTS line and 15.5 is the Maintenance LTS line.
- npm install next@16.4.1 for apps on 16.4
- npm install next@15.5.28 for apps on 15.5
The three advisories
RCE in "use cache" functions that return typed arrays (Critical)
GHSA-673q-mjm6-r5xr affects App Router apps using Cache Components when a "use cache" function returns multiple typed arrays. The affected range is 16.0.0 through 16.4.0, and the advisory scores it 9.5 on CVSS v4. The related React advisory, GHSA-xqc2-xf4c-x3h3, is fixed in the react-server-dom packages at 19.0.9, 19.1.10, 19.2.9 and 19.3.1.
There's no known workaround. Vercel says to upgrade even if you don't think your app has a function like this.
This lands right after Next.js 16.4, released October 6, which recommends Cache Components for every app and turns them on by default in create-next-app. A project started this month is likely on that path.
RCE in the Image Optimization API with SVG (Critical)
CVE-2026-96889 (GHSA-2464-fhr4-w9xw) is a memory bug in an upstream library Next.js uses for image optimization. It can lead to remote code execution when Next.js runs on glibc-based Linux. The affected range runs from 10.0.0 through 15.5.27, plus 16.x through 16.4.0.
The workaround is to make sure the sharp version Next.js uses is 0.35.5 or later. Upgrading Next.js to a patched version makes your package manager pull in a fixed sharp.
This one has the widest reach, all the way back to Next.js 10. Vercel only names patched releases for 15.5 and 16.4. If you maintain an older app on 13 or 14, pinning sharp to 0.35.5 or later is the stopgap, and an upgrade plan is the real fix.
Denial of service through Server Actions (High)
GHSA-p3m5-59mp-jv5r scores 8.2 on CVSS v4. Crafted requests to an App Router app with at least one Server Action can drive CPU usage high enough to block other requests in the same process. The affected range is 13.0.0 through 15.5.27, plus 16.0.0 through 16.4.0. The related React advisory is GHSA-h3gv-c5rc-p453.
Apps on the Pages Router, or apps with no Server Actions, aren't vulnerable. For everyone else there's no workaround besides upgrading.
On a lot of small business sites, the contact form is the one Server Action in the whole app. That alone puts the site in scope.
Who should move first
- App Router apps on 16.x that use Cache Components. This is the no-workaround RCE.
- Any app serving images through the built-in optimizer on glibc-based Linux. Patch, or confirm sharp is 0.35.5 or later.
- App Router apps with even one Server Action, like a form handler.
- Projects using the react-server-dom packages outside Next.js, for example with Parcel or webpack. Move to the patched React versions listed above.
A quick check for any project
- Run npm ls next sharp to see the versions actually installed, not just the ranges in package.json.
- Bump next to 16.4.1 or 15.5.28 and reinstall so the lockfile picks up the fixed sharp.
- Run npm ls sharp again and confirm it's 0.35.5 or later.
- Search the codebase for "use cache" and "use server" so you know which advisories applied, for your own records.
- Build, deploy to a preview, and click through forms and image-heavy pages before promoting.
What to watch
Two of the three advisories only carry GHSA IDs so far, with no CVE listed. Keep an eye on the advisories for CVE assignments or changes to affected ranges, and on the Next.js blog for follow-up notes. If your apps are already on 16.4.1 or 15.5.28 with sharp at 0.35.5 or later, you're done with this round.
