Affected Systems

Next.js versions 10.0.0–15.5.27 and 16.0.0–16.4.0. Critical RCE in React Server Components (v16 with Cache Components enabled, use cache functions returning multiple typed arrays). Critical RCE via librsvg/sharp (apps passing attacker-supplied SVGs to sharp on glibc Linux, or using next/og on Node.js runtime). High-severity DoS in Server Actions (App Router apps with at least one Server Action, v13.0.0+). Fixed in 16.4.1 and 15.5.28 with sharp 0.35.5+.

Exploitation Status

No active exploitation reported for these specific flaws. The React Server Components flaw (GHSA-673q-mjm6-r5xr) affects extremely rare cases. The librsvg flaw (CVE-2026-96889) has a public exploit for a related September next/og vulnerability; Red Hat rated it requiring user interaction, but Vercel considers it network-reachable. No CVE assigned yet for use cache or Server Actions flaws as of October 15.

Business Impact

Organizations running Next.js face critical remote code execution risk if they enable Cache Components in v16, process attacker-controlled SVG files via sharp on Linux, or use next/og for social preview images. The DoS flaw can exhaust CPU on App Router deployments with Server Actions, blocking legitimate requests. Exposure varies by hosting platform (e.g., Netlify reports limited impact). Dependency scanners may not detect use cache and Server Actions flaws due to missing CVEs and npm advisory entries. This is the third image-processing RCE in Next.js since August 2026, indicating recurring supply-chain risk in image libraries.

Urgency

🔴 Immediate

Recommended Actions

  • ["Upgrade to Next.js 16.4.1 (if running v16) or 15.5.28 (if running v15), then rebuild and redeploy all applications immediately"]
  • ["Verify sharp package is version 0.35.5 or later using 'npm ls sharp' — v15 upgrades may leave vulnerable sharp 0.34.x in place"]
  • ["If immediate upgrade is not possible, update sharp to 0.35.5+ or block SVG rendering with sharp.block({ operation: ['VipsForeignLoadSvg'] }) as interim mitigation for image RCE only"]
  • ["Audit App Router applications for use of Cache Components (v16), dangerouslyAllowSVG setting, next/og on Node.js runtime, and Server Actions to determine exposure scope"]
  • ["Monitor for CVE assignments and npm advisory updates for GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r, as automated scanners may not currently detect these flaws"]