---
title: "Next.js & React security release (Oct 2026): what to know"
description: "Three Next.js/React vulnerabilities disclosed: an image RCE, a use cache RCE, and a Server Action DoS. Affected Netlify projects should upgrade."
source: "https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/"
last_updated: "2026-10-15T04:38:40.000Z"
---
The Next.js and React teams have disclosed three security vulnerabilities (two critical, one high), released on October 14, 2026: a remote code execution (RCE) in SVG image processing, an RCE in `use cache` (Cache Components), and a denial of service (DoS) in App Router Server Actions. Here’s what Netlify customers need to know.

## Summary

If you run Next.js on Netlify, **we strongly recommend upgrading `next` to 15.5.28 or 16.4.1** and redeploying. Several of these have limited or no impact on Netlify; see [Impact on Netlify](#impact-on-netlify). See [What should I do?](#what-should-i-do) for steps.

## Vulnerabilities

All issues are patched in **15.5.28** and **16.4.1**.

Vulnerability

Severity

Affected

[GHSA-673q-mjm6-r5xr](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr) — Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

Critical

16.x apps using Cache Components with a `use cache` function returning typed arrays

[GHSA-2464-fhr4-w9xw](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw) — Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used ([CVE-2026-96889](https://www.cve.org/CVERecord?id=CVE-2026-96889))

Critical

Processing untrusted SVGs via `sharp` (Node.js runtime, glibc Linux); on Netlify, reachable through `next/og` `ImageResponse`

[GHSA-p3m5-59mp-jv5r](https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r) — Denial of Service in App Router using Server Actions

High

13.x–16.x App Router apps with at least one Server Action

## Impact on Netlify

### Remote code execution

[GHSA-673q-mjm6-r5xr](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr) is a **Critical** RCE affecting Next.js 16.x apps using Cache Components, triggered by a `use cache` function that returns typed arrays — an unusual configuration not expected in normally functioning applications. On Netlify, apps that meet those conditions are **affected**; upgrading Next.js resolves it.

[GHSA-2464-fhr4-w9xw](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw) ([CVE-2026-96889](https://www.cve.org/CVERecord?id=CVE-2026-96889)) is an RCE in the image library (`sharp`) Next.js uses to process SVGs. The advisory describes it through the next/image Image Optimization API — which on Netlify is served by [Netlify Image CDN](https://docs.netlify.com/build/image-cdn/overview/), not your function, so that path is **not exercised on Netlify**. The same flaw is reachable through `next/og` `ImageResponse`, which does run in your Netlify function: apps that render untrusted input via `ImageResponse` are **affected**. There, the impact is limited to a crashed function invocation, not code execution — **minimal impact** on our autoscaling serverless architecture, though active exploitation could increase your function costs. Upgrading Next.js (which also updates the bundled `sharp`) resolves it.

### Denial of service

[GHSA-p3m5-59mp-jv5r](https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r) is a server-side DoS affecting App Router apps that define a Server Action. **On Netlify, this has minimal impact**: our autoscaling serverless architecture means a malicious request that consumes excessive CPU in one function does not affect other requests. However, active exploitation could increase your function costs. Upgrading Next.js resolves it.

## What should I do?

We strongly recommend **upgrading `next` to 15.5.28 or 16.4.1** and redeploying as soon as possible.

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).

## Resources

-   [Next.js Security Update for Upstream Vulnerabilities](https://nextjs.org/blog/nextjs-security-update-october-14-2026)
-   [Next.js security advisories](https://github.com/vercel/next.js/security)