Next.js 16.4.1 patches two critical remote code execution bugs

Any Next.js app that serves a user-uploaded picture may be running attacker code before the next page loads. Vercel released Next.js 16.4.1 on 14 October to patch two unauthenticated remote code execution bugs and a high-severity denial of service in Server Actions, with matching fixes for the 15.x line in Next.js 15.5.28.

The first critical bug, CVE-2026-96889, sits in the Image Optimization API when a request serves an SVG file. The underlying problem is in sharp, the image library Next.js uses, and it reaches remote code execution on any Next.js server running on glibc-based Linux, which covers almost every production deployment. GitHub rates it 9.5 on CVSS v4. The vulnerable range runs from Next.js 10.0.0 to 15.5.27 and from 16.0.0 to 16.4.0, so the bug has sat in the framework for most of its history. A fresh install picks up a patched sharp, but existing projects need the Next.js upgrade to force the dependency up.

The second critical bug, GHSA-673q-mjm6-r5xr, is a remote code execution path in 'use cache' functions that return typed arrays, affecting every version from 16.0.0 to 16.4.0. Vercel's own advisory for a related earlier 'use cache' bug, published on 30 September, describes the same cache component area and said there were no workarounds. The pattern repeats here, so an application that uses Cache Components, enabled by cacheComponents: true in next.config.js, has to upgrade. Turning the flag off is not listed as a workaround on the earlier advisory, and the current advisory names no workaround at all.

The denial of service

GHSA-p3m5-59mp-jv5r is a high-severity denial of service in App Router when Server Actions are in use. It reaches back as far as Next.js 13.0.0 on the 13 to 15 line and every 16.x release before 16.4.1, so it has been in the framework for three years. The release notes list it alongside the two RCEs and give no further detail; the advisory page is where to look for the exact trigger.

Who has to act today

Any team shipping a Next.js app that serves user-supplied images, uses the 'use cache' directive, or handles Server Actions has an unauthenticated code execution bug sitting in production until the patch lands. Vercel's own hosted deployments pick up the fix on redeploy. A self-hosted install needs npm install next@16.4.1 or next@15.5.28, with Node.js 18.18.0 or later for the 16.x line. The CVSS 9.5 on the SVG bug is Vercel's own working, and the SVG path is reachable with no authentication: a public form that accepts an image upload is enough.

Source

Next.js v16.4.1 release notes, Vercel. See also GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r.