Skip to contentistheinternetok
All incidents

Security flaw·Critical

Next.js: two critical remote code execution flaws

Fix availableAffects website owners
Next.js, sharp

What it changes for you

Nothing visible for you; site owners must update.

Next.js, a popular framework used to build websites, fixed two critical flaws that could let an attacker take over a server, plus one that can make sites stop responding. Visitors have nothing to do; site owners using Next.js should update.

Started Oct 14, 2026Updated Oct 14, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
Upgrade next to 16.4.1 (16.x) or 15.5.28 (15.x) and redeploy. The use cache flaw has no workaround. If you cannot upgrade right away, make sure the sharp version used by Next.js is 0.35.5 or later.

What is affected

CVE-2026-96889

Timeline

  1. Fix available · Oct 14, 2026

    Next.js 16.4.1 and 15.5.28 released: fixes an unauthenticated RCE in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr), an RCE in the Image Optimization API with SVG on glibc Linux (CVE-2026-96889), and a Server Actions denial of service (GHSA-p3m5-59mp-jv5r).

    nextjs.org

  2. Identified · Oct 8, 2026

    Next.js announces an out-of-band security update for October 14, covering two critical and one high severity issues in upstream dependencies.

    nextjs.org

Sources