Next.js Patches Two Critical Unauthenticated RCE Flaws, Urges Immediate Upgrade
rez0__ · x · 2026-10-16
Next.js shipped an out-of-band security update fixing two critical unauthenticated RCE vulnerabilities plus a high-severity DoS.
- use cache flaw: with App Router + Cache Components, a use cache function returning multiple typed arrays enables unauth RCE; no workaround exists — upgrade even if you don't use such functions (related upstream React advisory GHSA-xqc2-xf4c-x3h3).
- Image Optimization API flaw (CVE-2026-96889): a memory bug in an upstream library enables RCE on glibc-based Linux when handling SVG; workaround is ensuring sharp >= 0.35.5.
- Server Actions DoS (high): crafted requests can trigger denial of service.
Patched in v16.4.1 (Active LTS) and v15.5.28 (Maintenance LTS).
Related event: Next.js Patches Critical Unauthenticated RCE Flaws, Urges Immediate Upgrade(2 posts)→
More from Safety
- Super-Worms Warning: AI-Powered Self-Propagating Malware and a Fragmenting Internet — JensHonack · 2026-10-23
- Claude Code Pushes Urgent Security Update Across All Installations — umeshonai · 2026-10-23
- Sanders calls to pause autonomous AI agents in bank accounts; critics push back — AIandDesign · 2026-10-23
- TechPolicy essay: system prompts are weak evidence of AI safety, outputs must be evaluated — mmitchell_ai · 2026-10-23
- Anthropic's deputy security chief warns cyber threats will get 'a lot worse before they get better' — Polymarket · 2026-10-23
- AI cyberattacks could paradoxically accelerate AI development in an offense-defense arms race — kimmonismus · 2026-10-23