Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js issued an out-of-band security update on October 14. It fixes three separate vulnerabilities. Two can allow unauthenticated remote code execution, meaning an attacker may run code without logging in. The third can consume a server process’s CPU and cause denial of service.

One critical flaw affects React Server Components in narrowly defined Next.js 16 applications using Cache Components and use cache. The other comes from librsvg, reached through the sharp package when Next.js processes SVG images or generates next/og images on Node.js. A separate Server Actions flaw affects certain App Router applications.

The fixed releases are Next.js 16.4.1 and 15.5.28. Developers should upgrade, rebuild, and redeploy. Version 16.4.1 requires sharp 0.35.5, but version 15.5.28 can retain an older sharp 0.34.x installation, so version 15 users must check sharp separately.

Unauthenticated remote code execution means a person can send specially crafted data to a vulnerable application and make the server execute attacker-chosen instructions. No account, password, or prior access is required. That combination makes the weakness especially dangerous for internet-facing applications.

In this incident, the possible paths include React Server Components, SVG processing through sharp and librsvg, and particular Server Action requests. The article rates the two code-execution flaws critical, each with a CVSS score of 9.5. The image path can be reachable over the network when the relevant processing occurs.

The practical impact depends on the application’s features and environment. A successful attacker could potentially use the server’s existing permissions and resources to affect application operations. The article does not describe a complete exploit outcome for every deployment, so exposure varies by configuration, runtime, operating system, and hosting platform.

Next.js fixed three distinct security issues in the out-of-band release. Two involve possible unauthenticated remote code execution. One is in React Server Components, and the other is a memory bug in librsvg, which Next.js reaches through sharp for image handling.

Vercel rated both code-execution issues critical. Each received a CVSS score of 9.5. The third issue affects Server Actions in App Router applications. Crafted requests can drive one server process to full CPU use, preventing it from handling other requests.

That third vulnerability is classified as high severity rather than critical because its stated effect is denial of service, not code execution. Exposure is narrower there: applications using the Pages Router are not affected, and neither are applications with no Server Actions. The article also notes that npm audit did not list the use cache or Server Actions issues as of October 15.

The React Server Components flaw affects only Next.js 16 applications that enable Cache Components, the feature behind use cache. The triggering function returns more than one typed array. Vercel still recommends upgrading even when an application has no such function.

The image flaw depends on how images are handled. Next.js does not optimize SVG files by default. Exposure rises when dangerouslyAllowSVG is enabled for the image optimizer. The same library also processes next/og images when that feature runs on the Node.js runtime. The advisory specifically identifies glibc-based Linux as vulnerable.

The denial-of-service flaw requires an App Router application with at least one Server Action. Pages Router applications are not affected, nor are applications without Server Actions. Hosting can change exposure too: Netlify said its platform does not run the image-optimizer path, while still recommending the upgrade.

A vulnerable use cache path can reach the React Server Components flaw when a function returns multiple typed arrays and an attacker-controlled value is transported. The article classifies this as possible unauthenticated remote code execution. It affects only the specified Next.js 16 configuration, but Vercel advises upgrading regardless.

A crafted SVG can reach the librsvg memory bug when Next.js processes SVG data through sharp. This may allow code execution on glibc-based Linux. SVG processing can occur through the image optimizer when dangerouslyAllowSVG is enabled, or through next/og on the Node.js runtime. The server’s Node.js build can affect whether exploitation becomes code execution or only a crash.

A crafted Server Action request has a different result. It can push one App Router server process to full CPU use and stop that process from handling other requests. The use cache and Server Actions issues have no workaround; upgrading is required.

Updating a framework does not always replace every transitive dependency with a safe version. Next.js uses sharp for image handling, and sharp includes the librsvg code involved in the image-processing vulnerability. The fixed sharp release is 0.35.5 or later.

On Next.js 16, version 16.4.1 requires sharp 0.35.5, so package managers supply the fixed version. On Next.js 15, version 15.5.28 still accepts sharp 0.34.x. An upgrade over an existing installation can therefore leave an older, affected sharp version in place.

Version 15 users should run npm ls sharp and update sharp when it is older than 0.35.5. If Next.js cannot be upgraded immediately, the article gives two image-flaw options: install sharp 0.35.5 or later, or block SVG rendering with sharp.block. These options do not address the other two flaws.

Web frameworks often delegate specialized work to native libraries. Next.js uses sharp to process images, and sharp reaches librsvg for SVG rendering. This improves image support, but it also means a flaw in that lower-level code can affect applications that never directly call librsvg.

The article describes a librsvg memory bug that can lead to code execution when Next.js runs on glibc-based Linux. A crafted SVG reaches the vulnerable renderer through the image optimizer when dangerouslyAllowSVG is enabled, or through next/og when it generates images on Node.js. The malformed input targets memory handling inside the native library.

The final outcome depends partly on the server’s Node.js build. sharp’s maintainer warns that exploitation may result in code execution or only a crash because official Node.js binaries are not hardened against this kind of memory attack. Updating sharp to 0.35.5 or later brings the patched librsvg version.