Security Update: Next.js and React vulnerabilities (October 2026)
October 14, 2026
The Next.js and React teams have disclosed three security vulnerabilities (two critical, one high), released on October 14, 2026: a remote code execution (RCE) in SVG image processing, an RCE in use cache (Cache Components), and a denial of service (DoS) in App Router Server Actions. Here’s what Netlify customers need to know.
Summary
If you run Next.js on Netlify, we strongly recommend upgrading next to 15.5.28 or 16.4.1 and redeploying. Several of these have limited or no impact on Netlify; see Impact on Netlify. See What should I do? for steps.
Vulnerabilities
All issues are patched in 15.5.28 and 16.4.1.
| Vulnerability | Severity | Affected |
|---|---|---|
GHSA-673q-mjm6-r5xr — Unauthenticated Remote Code Execution in use cache functions returning typed arrays | Critical | 16.x apps using Cache Components with a use cache function returning typed arrays |
| GHSA-2464-fhr4-w9xw — Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used (CVE-2026-96889) | Critical | Processing untrusted SVGs via sharp (Node.js runtime, glibc Linux); on Netlify, reachable through next/og ImageResponse |
| GHSA-p3m5-59mp-jv5r — Denial of Service in App Router using Server Actions | High | 13.x–16.x App Router apps with at least one Server Action |
Impact on Netlify
Remote code execution
GHSA-673q-mjm6-r5xr is a Critical RCE affecting Next.js 16.x apps using Cache Components, triggered by a use cache function that returns typed arrays — an unusual configuration not expected in normally functioning applications. On Netlify, apps that meet those conditions are affected; upgrading Next.js resolves it.
GHSA-2464-fhr4-w9xw (CVE-2026-96889) is an RCE in the image library (sharp) Next.js uses to process SVGs. The advisory describes it through the next/image Image Optimization API — which on Netlify is served by Netlify Image CDN, not your function, so that path is not exercised on Netlify. The same flaw is reachable through next/og ImageResponse, which does run in your Netlify function: apps that render untrusted input via ImageResponse are affected. There, the impact is limited to a crashed function invocation, not code execution — minimal impact on our autoscaling serverless architecture, though active exploitation could increase your function costs. Upgrading Next.js (which also updates the bundled sharp) resolves it.
Denial of service
GHSA-p3m5-59mp-jv5r is a server-side DoS affecting App Router apps that define a Server Action. On Netlify, this has minimal impact: our autoscaling serverless architecture means a malicious request that consumes excessive CPU in one function does not affect other requests. However, active exploitation could increase your function costs. Upgrading Next.js resolves it.
What should I do?
We strongly recommend upgrading next to 15.5.28 or 16.4.1 and redeploying as soon as possible.
Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually.