Next.js has issued an out-of-band update for two critical unauthenticated remote-code-execution flaws and one high-severity denial-of-service issue. The fixed releases are Next.js 16.4.1 and 15.5.28; teams running affected versions should upgrade, rebuild, and redeploy rather than treating this as a routine dependency-maintenance task. thehackernews.com
For teams doing GEO work, the immediate concern is not an abstract framework CVE. It is the application machinery around publishable content: cache-backed rendering, user- or partner-supplied assets, image transformation, and social-preview generation. Those systems commonly sit directly on the paths used to publish pages, create previews, and serve visual assets to crawlers and users. The right response is patching first, followed by a narrow inventory of the actual caching and SVG-processing paths your deployment exposes.
Three issues, but two different RCE exposure models
The release addresses three separate issues. Two are rated critical with CVSS scores of 9.5: code execution through use cache and code execution through SVG image processing. The third is a denial-of-service flaw involving Server Actions. infosectoday.io
The cache issue affects Next.js 16.0.0 through 16.4.0 and is fixed in 16.4.1. Its exposure condition is narrower than the headline suggests: an App Router application must have Cache Components enabled, and a use cache function must return more than one typed array. The underlying React advisory describes the relevant conditions as “extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.” thehackernews.com
Narrow does not mean safe to defer. The report says Vercel recommends upgrading even where an application has no identified function matching that condition. That is a sensible operational position: proving that no cache output can evolve into this shape across current code, generated code, and future feature work is more fragile than moving to the patched release. thehackernews.com
The SVG issue, CVE-2026-96889, is a memory flaw in librsvg, reached by Next.js through the bundled sharp package. It affects Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0. Code execution is possible on glibc-based Linux where attacker-supplied SVG files reach sharp. thehackernews.com
These are materially different review jobs. The cache flaw requires developers to inspect framework feature adoption and return values. The SVG flaw requires teams to trace asset provenance and rendering paths. Conflating them into “we do not upload SVGs” can miss server-side generated preview flows; treating them both as package-version issues can miss a stale sharp resolution on version 15.
The patch is necessary, but version 15 has a dependency trap
On Next.js 16, upgrading to 16.4.1 brings sharp 0.35.5 because that release requires it. On Next.js 15, upgrading to 15.5.28 may not be enough by itself: that Next.js version still accepts affected sharp 0.34.x versions, so an upgrade over an existing installation can leave the older sharp package resolved. The reported verification step is npm ls sharp; if the installed version is older, update sharp to 0.35.5 or later. infosectoday.io
That distinction matters for teams with controlled deployment pipelines. A pull request that changes only the Next.js version may look correct in review while the built artifact still resolves an affected sharp release. The deployment check should therefore record both the final Next.js version and the resolved sharp version, especially for version 15 applications.
If a Next.js upgrade is temporarily blocked, the SVG flaw has an interim mitigation: use sharp 0.35.5 or later, or block SVG rendering in sharp with sharp.block({ operation: ["VipsForeignLoadSvg"] }). There is no workaround for the use cache or Server Actions issues; upgrading is the only stated way to close those flaws. thehackernews.com
What to inventory in a GEO-oriented Next.js estate
GEO teams often own or influence the publishing paths that make content discoverable and previewable: structured page generation, asset ingestion, editorial previews, programmatic landing pages, and metadata imagery. This does not establish exposure by itself. It does establish where an engineering review should begin.
- Cache Components and use cache: identify version 16 App Router deployments with Cache Components enabled. Review every use cache function returning typed arrays, particularly where an attacker-controlled value can contribute to the response. The documented trigger is more than one typed array returned by such a function. thehackernews.com
- SVG upload and transformation paths: locate any workflow where untrusted SVGs can reach sharp on glibc-based Linux. The relevant question is not whether SVG appears in the design system; it is whether an attacker-supplied SVG is rendered through the affected library chain. thehackernews.com
- Image optimizer configuration: Next.js does not optimize SVGs by default. Serving SVG via the image optimizer requires the dangerouslyAllowSVG setting, making that configuration a high-value review point. infosectoday.io
- Social-preview generation: inspect Node.js-runtime uses of next/og, because the same library renders images for that feature. For GEO operations, this includes preview-image endpoints tied to dynamically assembled content or inputs from editorial, partner, or user-controlled systems. thehackernews.com
- Server Actions: identify App Router applications defining at least one Server Action. Crafted requests can drive a server process to full CPU usage and prevent it from handling other requests; Pages Router applications and apps without Server Actions are not affected by this issue. thehackernews.com
The inventory should produce an answer more useful than “we use Next.js”: which deployed application version is running, whether sharp is patched, whether SVGs are accepted from untrusted sources, whether SVG optimization is enabled, and whether Node.js next/og routes exist. The sources do not provide a universal exposure assessment because hosting configuration and application behavior differ. One reported example is Netlify, which said it does not run the image-optimizer code path and therefore has limited impact, while still recommending an upgrade. thehackernews.com
Do not wait for npm audit to make the decision
As of October 15, the advisories for the use cache and Server Actions flaws had no CVE and were not present in the npm advisory feed used by npm audit. Dependency scanners therefore may not warn on them. The SVG flaw can surface through sharp’s own advisory, but a clean scanner result is not evidence that the other two issues are absent. thehackernews.com
This is the operational lesson for web teams: scanner-led patching has a blind spot when advisories have not reached the feeds your tooling consumes. For this incident, the authoritative remediation decision is the affected-version range and application feature use described in the published report, not whether a routine audit job emits a finding.
Why SVG routes deserve lasting attention
This is reported as the third image-processing code-execution issue affecting Next.js since August. A prior issue involved crafted AVIF images handled through sharp, while a September next/og flaw allowed attacker-controlled text to change generated SVG. The current Next.js release reportedly retains the same optimizer as 16.4.0 and resolves this issue by raising bundled sharp to 0.35.5, which includes patched librsvg 2.63.2. thehackernews.com
That history does not prove that all image features are unsafe. It does show why image handling should be treated as executable server-side processing rather than as a passive content concern. For practitioners responsible for search-facing content systems, preview assets and dynamic imagery are part of the production surface. They need the same dependency visibility and provenance review as content-rendering code.
There were no public reports, as of October 15, that any of these three flaws had been used in attacks. That is useful context, but it is not a reason to stage the upgrade behind ordinary roadmap work: the two RCE flaws are described as unauthenticated and critical, and both patched release lines are already available. thehackernews.com