Next.js 16.4.1 Fix: use cache RCE and SVG Image RCE

Next.js published an out-of-band release on 14 October 2026 that fixes two critical remote code execution bugs and one high-severity denial of service. Upgrade to 16.4.1 on the 16 line or 15.5.28 on the 15 line, reinstall so sharp resolves to 0.35.5 or later, rebuild, and redeploy. The use cache bug has no workaround. Upgrading is the fix.

Which Next.js versions are affected?

Every version below the fixed release on your line, with some differences between the three bugs. The ranges below come from the GitHub advisories, checked on 24 October 2026.

The September release does not help here. Versions 16.3.8 and 15.5.27 shipped on 30 September with fixes for other bugs, and two fixes were postponed to October because of upstream delays. If your lockfile says 16.3.8 or 15.5.27, you are one release behind.

The 15 line is not listed as affected by the use cache bug. Versions 10 to 14 have no patched release of their own in the SVG advisory. The Cloud Security Alliance note says apps on versions older than 15.5 need to move to a supported line.

Why does CVE-2026-96889 have three different scores?

Because three organisations describe three different things. The CVE was assigned by Red Hat to librsvg, the SVG library, and made public on 23 September 2026, three weeks before the Next.js release. The CVE record calls it a use-after-free. The upstream RustSec entry lists librsvg 2.63.2 as a patched version.

Next.js uses sharp for image optimisation, and sharp bundles librsvg. Each party scored it from its own position:

None of these is wrong. A scanner that reads only the CVE record sees the 7.8 and may rank it below other work. A site that serves images through the Next.js optimizer should use the 9.5. The record also has a second trap: the use cache bug has no CVE id at all, so a tool that works only from CVE lists will miss it. The Cloud Security Alliance note makes the same point.

Am I exposed if I do not use Cache Components or SVG files?

You cannot rule it out from the advisories, so treat the upgrade as required.

For use cache, the advisory says the bug needs an App Router app with Cache Components and a use cache function that returns multiple typed arrays. The Next.js docs say Cache Components is switched on with cacheComponents: true in next.config. React's own upstream advisory calls the condition extremely rare. If you never confirmed the earlier React flaw, the React2Shell version check covers it. Even so, the Next.js advisory says to upgrade immediately even if your application has no such functions.

For SVG, the Next.js docs say Next.js does not optimize SVG images by default, and dangerouslyAllowSVG turns that on. The advisory does not say whether the default configuration avoids the bug. Netlify says apps that render untrusted input with next/og are affected on its platform, with the impact limited to a crashed function invocation there.

Two details change who is in scope. The advisories name glibc-based Linux for code execution. They do not say Alpine and other musl systems are exempt, so do not read the wording as an exemption. A Node.js binary built as a Position Independent Executable matters too, and the sharp advisory notes that the official Node.js binaries are not built that way. The runtime has its own October Node.js patch release, which is a separate upgrade.

How do I fix it?

Upgrade, refresh the dependency tree, rebuild, and redeploy. The fix reaches sharp through the build, so a changed package.json alone does nothing until a new build is running.

If you run the server or the container yourself

• Upgrade with npm install next@16.4.1 (16 line) or npm install next@15.5.28 (15 line), or the equivalent in pnpm, yarn or bun.
• Run npm ls next sharp and read the resolved versions. A lockfile can keep an old sharp. The target is sharp 0.35.5 or later.
• If you use react-server-dom-webpack, -turbopack or -parcel directly, move them to 19.0.9, 19.1.10, 19.2.9 or 19.3.1 as the React advisory lists.
• Rebuild the Docker image with a fresh install and replace the running container. Check every image that runs Next.js, including preview and staging.
• Remove public preview and branch deployments that still run an old build. Netlify warns they may stay vulnerable until deleted.
• Look at the build log or npm ls output inside the new image, not only on your laptop.

If you truly cannot upgrade today, the Next.js advisory allows one stopgap for the SVG bug only: make sure the sharp used by Next.js is 0.35.5 or later. The sharp advisory adds a second one, blocking sharp from decoding SVG, and says a PIE Node.js build avoids code execution for this bug. None of these covers the use cache bug, which has no workaround.

If a platform or agency deploys it for you

Platforms differ. Netlify says to upgrade next to 15.5.28 or 16.4.1 and redeploy. Pantheon says it does not update Next.js sites for customers. At our check we found no Vercel statement for this release, so do not assume the platform did it for you. Send this to whoever owns the deployment, and keep the reply:

For [your domain], which Next.js version and which sharp version are in the build that serves production today? Was it built after 14 October 2026? If it was built before, please upgrade to 15.5.28 or 16.4.1, redeploy, and tell me the deploy time and the commit.

Who owns each layer when an agency and a host are both involved is covered in this guide to patching ownership.

Am I affected? A three-state self-test

Was it exploited, and what should I look for?

At our check on 24 October 2026 we found no primary source reporting exploitation of either critical bug. The Cloud Security Alliance note found no public reports as of 15 October, and the CISA catalog data we read did not list either issue. CISA's enrichment on the CVE record lists exploitation as "poc" (timestamp 25 September 2026) and points at the upstream librsvg issue. That is a state label on the library flaw, not a report about a Next.js site.

The window to review starts earlier than 14 October. The librsvg flaw and its fix have been public since 23 September, and sharp 0.35.5 was released on 27 September, per the sharp release page. The Cloud Security Alliance note suggests reviewing logs from 23 September for odd SVG requests to the image route, unexpected crashes, and CPU spikes. For a server that was reachable and unpatched, also look for processes started by the Node.js user that you do not recognise, and outbound connections you cannot explain. If you find evidence, rotate the environment variables and tokens that process could read, and follow a sensible order for rotating secrets.

A denial of service shows as one process pinned at high CPU that stops answering. That matches the Server Actions bug, and is a reason to upgrade, not proof of an intrusion.

What is each bug, in plain terms?

• use cache RCE. An App Router app with Cache Components can be made to run code when a use cache function returns several typed arrays. The advisory publishes no further mechanism, and neither do we.
• SVG image RCE. A memory-safety fault in librsvg, reached through sharp when an SVG is processed. The condition for code execution is glibc-based Linux. Next.js says the fix arrives with the upgrade, because the new release pulls in a fixed sharp.
• Server Actions DoS. Crafted requests to an App Router app with at least one Server Action cause excessive CPU use that blocks other requests in the same process. Telling App Router from Pages Router is the quick way to see whether that one applies to you.

The Next.js team credited evolutionstorm for the use cache report and randomguy6407 and rafabd1 for the SVG report.

What is the order of work this week?

If you want an outside view of what a site shows, the free scan identifies the technologies your site serves and looks each version up in public vulnerability records. It is a lookup. It can say a version is affected, not whether your setup is exposed. More patch notes like this one are in the other framework guides. The smaller-site view of this month is in the small business round-up.